fix: a permit on the zero address never reads as ETH (closes #660)

Permit2 has no allowance of ETH, but the swap decoder read a permit's
zero-address token as ETH. Its Allowance token line read ETH. A permit of
1 wei of the zero address before a V4 step of 5 ETH also stood as the
Amount figure, which then read 0.000000000000000001 ETH.

Such a permit now never stands as the Amount figure. Its lines give the
amount in base units and name the zero address, as for a token nothing
knows.

Model: opus-5-5

README.md

@@ -17,11 +17,11 @@ and don't implement any crypto. By default the wallet sends user-specific data
 only to the Ethereum RPC endpoint. The user can change that endpoint in
 Settings. The endpoint defaults to a public node.
 
-Out of the box the extension contacts one service, the configured RPC node. The
-wallet uses the node for:
+Out of the box the extension contacts two services:
 
-- blockchain interactions
-- USD prices on mainnet, read from Chainlink price feed contracts
+- the configured RPC node, for blockchain interactions
+- a public CoinDesk API (no API key), for realtime prices. The API receives
+  token symbols and nothing else.
 
 Two more services are sent none of the user's data until the user ticks a
 checkbox for each. Welcome and Settings both offer the two checkboxes:
@@ -902,14 +902,13 @@ src/
     constants.js      — chain IDs, default RPC endpoint, ERC-20 ABI
     ens.js            — ENS forward/reverse resolution (popup only)
     holders.js        — holder-count parsing and the low-holder rule
-    prices.js         — ETH/USD and token/USD from Chainlink price feeds
+    prices.js         — ETH/USD and token/USD via CoinDesk API
     scamlist.js       — known fraud contract addresses
     state.js          — persisted state (extension storage)
     storedSettings.js — "Use Blockscout" and "Check recipients on Etherscan",
                         read from storage for the requests those settings gate
     symbolSpoof.js    — the known-symbol spoof rule, shared by all surfaces
-    tokenList.js      — top ERC-20 tokens by market cap, and their Chainlink
-                        price feeds (hardcoded)
+    tokenList.js      — top ERC-20 tokens by market cap (hardcoded)
     transactions.js   — tx history fetching + anti-poisoning filters
     uniswap.js        — Uniswap Universal Router calldata decoder
     vault.js          — password-based encryption via libsodium
@@ -1188,12 +1187,11 @@ The wallet takes the `decimals` from these sources, in this order
   "Use Blockscout" is on (`tokenSourcesByChainId()` in
   `src/popup/views/helpers.js`).
 
-The token's name comes from the same sources. The bundled token list is used
-only for a token on Ethereum Mainnet. While "Use Blockscout" is off, a token
-gets a line under it when the bundled list and the tracked tokens lack its name
-or decimals. The line says "Blockscout's report of your balances is not used to
-name this token, because "Use Blockscout" is off in Settings." These screens
-show the line:
+The token's name comes from the same sources. While "Use Blockscout" is off, a
+token gets a line under it when the bundled list and the tracked tokens lack its
+name or decimals. The line says "Blockscout's report of your balances is not
+used to name this token, because "Use Blockscout" is off in Settings." These
+screens show the line:
 
 - TxApproval and SignApproval
 - WaitTx, SuccessTx and ErrorTx, which follow TxApproval
@@ -1278,18 +1276,22 @@ see Transaction Decoding), do not always read as a number. They can read:
   step pays nothing itself and swaps whatever an earlier step sent to the pair,
   so the calldata states no quantity. A V3 exact-in `amountIn` of zero has no
   such meaning and is shown as a zero.
-- `None (no minimum guaranteed)`: the swap's `Min. received` line, when it shows
-  a V2, V3 or V4 swap's minimum of zero. The router passes a
-  `BALANCE_CHECK_ERC20` step whenever the balance is at least `minBalance`, so a
-  zero `minBalance` guarantees nothing. A check with a zero `minBalance` sets
-  neither `Token Out` nor `Min. received`. A nonzero `minBalance` sets both
-  lines, as a swap step does. Only a check of the transaction's sender's own
-  balance sets either line; a check of any other address sets neither (see
-  Transaction Decoding). A `BALANCE_CHECK_ERC20` step that the router lets fail
-  without reverting the transaction (see Transaction Decoding) guarantees
-  nothing either, whatever its `minBalance`, and is read as one whose
-  `minBalance` is zero. A minimum stated by a V4 swap step the router lets fail
-  is likewise read as zero.
+- `None (no minimum guaranteed)`: the swap's `Min. received` line, when the
+  minimum it shows is zero, whether a V2, V3 or V4 swap's minimum or a
+  `BALANCE_CHECK_ERC20` step's `minBalance`. Before
+  [#359](https://git.eeqj.de/sneak/AutistMask/issues/359), a zero `minBalance`
+  read `0.0000` when the token's scale was known. The router passes a balance
+  check whenever the balance is at least `minBalance`, so a zero `minBalance`
+  guarantees nothing: it sets `Token Out` and `Min. received` only when the
+  output side holds no minimum, not even a zero one, at the point the check is
+  reached, and otherwise leaves the current token and figure in place. A nonzero
+  `minBalance` sets both lines, as a swap step does. Only a check of the
+  transaction's sender's own balance sets either line; a check of any other
+  address sets neither (see Transaction Decoding). A `BALANCE_CHECK_ERC20` step
+  that the router lets fail without reverting the transaction (see Transaction
+  Decoding) guarantees nothing either, whatever its `minBalance`, and is read as
+  one whose `minBalance` is zero. A minimum stated by a V4 swap step the router
+  lets fail is likewise read as zero.
 
 The swap's `Token In` and `Token Out` lines name a currency, not an amount; each
 reads `Unknown (not named in the calldata)` when the decoder found no token for
@@ -1369,10 +1371,10 @@ whole swap undecoded.
 
 #### Partial USD totals
 
-Only a token with a Chainlink price feed has a price, so an address can hold
-assets the extension has no price for. Worth zero and worth an unknown amount
-are different facts and are never collapsed into one number. `getAddressValue()`
-in `src/shared/prices.js` returns `{ usd, partial }` — the value of the priced
+Prices are fetched for the top 25 tokens only, so an address can hold assets the
+extension has no price for. Worth zero and worth an unknown amount are different
+facts and are never collapsed into one number. `getAddressValue()` in
+`src/shared/prices.js` returns `{ usd, partial }` — the value of the priced
 holdings, and whether an unpriced holding was left out of it — and every screen
 renders it through `formatAddressTotal()`, so the wording cannot drift:
 
@@ -1474,20 +1476,20 @@ tracked.
 
 A tracked token is shown when its balance is nonzero, and any other ERC-20 when
 its balance is nonzero and it is in the bundled known-token list or has 1,000 or
-more holders. On Ethereum Mainnet, a token that claims a bundled token's symbol
-from another contract is always dropped, tracked or not. On every network, a
-token claiming a label of the native asset is always dropped. Those labels are
-`"ETH"` and each network's `nativeCurrency`, such as `"SepoliaETH"`. The balance
-list applies all three rules whatever the settings say. The "Hide tokens with
-fewer than 1,000 holders" setting governs only the transaction history and the
-send-screen token selector. A token's holder count is unknown when the explorer
-reports none, or reports anything other than a whole number written in digits
-alone, such as `1,000` or `1e3` (`parseHoldersCount()` in
-`src/shared/holders.js`). This list does not take an unknown count as 1,000 or
-more, so such a token is shown only when it is on the bundled list or tracked.
-Every nonzero holding of a token shown is stored exactly, however small, but a
-holding below 0.000001 is left out of the balance lists, the send-screen token
-selector, the address total and the remove-address warning
+more holders. A token claiming a symbol from the bundled list from any other
+contract address is always dropped, tracked or not, and so is any token claiming
+a symbol that belongs to the native asset and therefore has no legitimate
+contract at all (`"ETH"`, and every network's `nativeCurrency`, such as
+`"SepoliaETH"`, on every network). That filter is unconditional — the "Hide
+tokens with fewer than 1,000 holders" setting governs the transaction history
+and the send-screen token selector, not this list. A token's holder count is
+unknown when the explorer reports none, or reports anything other than a whole
+number written in digits alone, such as `1,000` or `1e3` (`parseHoldersCount()`
+in `src/shared/holders.js`). This list does not take an unknown count as 1,000
+or more, so such a token is shown only when it is on the bundled list or
+tracked. Every nonzero holding of a token shown is stored exactly, however
+small, but a holding below 0.000001 is left out of the balance lists, the
+send-screen token selector, the address total and the remove-address warning
 (`isBelowOneMillionth()` in `src/shared/amountDisplay.js`). The Send and
 confirmation screens show it when its token is the one being sent. Tracked
 tokens with a zero balance are listed as well while "Show tracked tokens with
@@ -2278,11 +2280,6 @@ view would leave a wallet one click from deletion.
         - Endpoint URL input + "Save" button. "Save" asks the URL for `/stats`
           and saves the URL only if that request succeeds. The request carries
           no user data and is made whether or not "Use Blockscout" is ticked.
-    - If the network changes before either "Save" stores its URL, the URL is not
-      saved and a flash message says so
-    - Either "Save" stores its URL only if the input still shows that URL when
-      the endpoint answers. Otherwise a flash message says that the URL was not
-      saved
     - Etherscan:
         - "Check recipients on Etherscan" checkbox, unticked until the user
           ticks it
@@ -2857,9 +2854,9 @@ view would leave a wallet one click from deletion.
 
 ### External Services
 
-AutistMask is not a fully self-contained offline tool. By default it contacts
-only the Ethereum RPC endpoint. USD prices are read from Chainlink price feed
-contracts through that endpoint.
+AutistMask is not a fully self-contained offline tool. By default it sends the
+user's data only to the Ethereum RPC endpoint. It also asks the CoinDesk price
+API for prices, sending token symbols and nothing else.
 
 Two more services are sent none of the user's data until the user turns on a
 setting for each:
@@ -2883,18 +2880,21 @@ Contacted by default:
   estimate gas (`eth_estimateGas`), fetch nonces (`eth_getTransactionCount`),
   broadcast transactions (`eth_sendRawTransaction`), and check transaction
   receipts. Every ENS lookup is made through the RPC endpoint alone. So a name
-  does not resolve when its resolver says the name is resolved off-chain. On
-  mainnet the extension also reads USD prices from Chainlink price feed
-  contracts (`latestRoundData`). The prices of ETH and of each held or tracked
-  token with a feed are read as one batched request. That request is sent at
-  most every 5 minutes while the popup is open. The default endpoint is a public
-  RPC (configurable by the user to any endpoint they prefer, including a local
-  node). By default the extension talks to
+  does not resolve when its resolver says the name is resolved off-chain. The
+  default endpoint is a public RPC (configurable by the user to any endpoint
+  they prefer, including a local node). By default the extension talks to
   `https://ethereum-rpc.publicnode.com`.
     - **Data sent**: Ethereum addresses, transaction data, contract call
       parameters. The RPC endpoint can see all on-chain queries and submitted
       transactions.
 
+- **CoinDesk CADLI price API**: Used to fetch ETH/USD and token/USD prices for
+  displaying fiat values. The price is cached for 5 minutes to avoid excessive
+  requests. No API key required. No user data is sent — only a list of token
+  symbols. Note that CoinDesk will receive your client IP.
+    - **Data sent**: Token symbol strings only (e.g. "ETH", "USDC"). No
+      addresses or user-specific data.
+
 Sent the user's data only while its setting is on:
 
 - **Blockscout block-explorer API** ("Use Blockscout"): The default endpoint is
@@ -3070,13 +3070,14 @@ hardcoded test phrase.
 
 At the raised log level the console also shows the wallet's addresses with their
 balances and ENS names, the token contracts looked up, and a line for each
-request made through `debugFetch` in `src/shared/log.js` (the explorer, the RPC
-calls a site makes, and the endpoint checks in settings) and for its response. A
-request is logged by its HTTP method, the origin of its URL (scheme, host and
-port) and, for a JSON-RPC call, the method name; the balance refresh, the token
-lookup and a failed endpoint check in settings name the endpoint by its origin
-too. The URL's path and query string, where RPC providers put API keys, any user
-name and password in it, and the request body are never logged.
+request made through `debugFetch` in `src/shared/log.js` (the explorer, the
+price feed, the RPC calls a site makes, and the endpoint checks in settings) and
+for its response. A request is logged by its HTTP method, the origin of its URL
+(scheme, host and port) and, for a JSON-RPC call, the method name; the balance
+refresh, the token lookup and a failed endpoint check in settings name the
+endpoint by its origin too. The URL's path and query string, where RPC providers
+put API keys, any user name and password in it, and the request body are never
+logged.
 
 ### Key Decisions
 
@@ -3199,25 +3200,26 @@ indexes it as a real token transfer.
   Ethereum mainnet ERC-20s taken from the CoinGecko API, with decimals verified
   on-chain and addresses EIP-55 checksummed; `TOKENS` in
   `src/shared/tokenList.js` is the authoritative set. It is bundled at build
-  time and only changes when that file is regenerated. On Ethereum Mainnet, a
-  token that claims a symbol from this list, such as "USDT" or "USDC", is a
-  spoof unless its contract is the listed one. The wallet hides it. The fake
-  "Ethereum" token in the attack above used symbol "ETH" from contract
-  `0xD05339f9Ea5ab9d9F03B9d57F671d2abD1F55c82`. No contract may bear "ETH", so
-  that token is a spoof. Detecting a spoof is also what adds a contract to the
-  fraud contract blocklist below; that is the only thing that populates it. In
-  the transaction history the check is the "Hide fake tokens impersonating a
-  known symbol" setting, on by default; with it off, spoofed transfers are shown
-  and no new blocklist entries are learned from them. The send-screen token
-  selector and the balance list apply the same check unconditionally, because
-  they decide which tokens the user can act on and what the user believes they
-  own rather than what the history displays. All three surfaces read the rule
-  from `src/shared/symbolSpoof.js`, so they cannot answer the question
-  differently. A symbol the list maps to no contract at all — the native asset's
-  labels: `"ETH"` and every network's `nativeCurrency`, such as `"SepoliaETH"`,
-  on every network — may be borne by no contract, so every ERC-20 claiming it is
-  a spoof on all three. The user's real ETH balance is not an ERC-20 and is read
-  over RPC, so the rule never sees it.
+  time and only changes when that file is regenerated. Any token transfer
+  claiming a symbol from this list (e.g. "ETH", "USDT", "USDC") but originating
+  from an unrecognized contract address is identified as a spoof and filtered
+  from display. The fake "Ethereum" token in the attack above used symbol "ETH"
+  from contract `0xD05339f9Ea5ab9d9F03B9d57F671d2abD1F55c82`, which does not
+  match the known WETH contract — so it would be caught by this check. Detecting
+  a spoof is also what adds a contract to the fraud contract blocklist below;
+  that is the only thing that populates it. In the transaction history the check
+  is the "Hide fake tokens impersonating a known symbol" setting, on by default;
+  with it off, spoofed transfers are shown and no new blocklist entries are
+  learned from them. The send-screen token selector and the balance list apply
+  the same check unconditionally, because they decide which tokens the user can
+  act on and what the user believes they own rather than what the history
+  displays. All three surfaces read the rule from `src/shared/symbolSpoof.js`,
+  so they cannot answer the question differently. A symbol the list maps to no
+  contract at all — the native asset's labels: `"ETH"` and every network's
+  `nativeCurrency`, such as `"SepoliaETH"`, on every network — may be borne by
+  no contract, so every ERC-20 claiming it is a spoof on all three. The user's
+  real ETH balance is not an ERC-20 and is read over RPC, so the rule never sees
+  it.
 
 - **Low-holder token filtering**: Token transfers from ERC-20 contracts with
   fewer than 1,000 holders are hidden from transaction history by default.
@@ -3396,8 +3398,7 @@ Currently supported:
   `Balance Check (of another address)`. A check whose input does not decode,
   such as one whose owner word has a nonzero top byte (the router reads the
   owner from the word's last 20 bytes), likewise sets neither, and it is listed
-  as `Balance Check (could not be decoded)`. A check with a zero `minBalance`
-  sets neither `Token Out` nor the minimum. When a swap step, `TAKE` or
+  as `Balance Check (could not be decoded)`. When a swap step, `TAKE` or
   `TAKE_PORTION` pays the router any token, the swap's output or another, a
   `WRAP_ETH` pays it WETH, or an `UNWRAP_WETH` into the router turns WETH a step
   paid it into ETH, that token stays in the router unless a later step pays out
@@ -3479,101 +3480,91 @@ Currently supported:
   of any amount but `OPEN_DELTA` pays that amount, and a `SETTLE` of
   `OPEN_DELTA` or a `SETTLE_ALL` pays what the step owes, as above. So a V4 step
   that swaps 400 USDT, with a `SETTLE` of 5,000 USDT paid by the user and the
-  rest taken to another address, reads `5000.0000 USDT`. A later step that pays
-  an ERC-20 token from the router takes none of that token from the user's
-  wallet. A V2 exact-in whose `amountIn` is `ALREADY_PAID` takes nothing either.
-  A V4 `SETTLE` of ETH paid from the router still takes from the user's wallet,
-  since the router holds the transaction's value. When the decoder does not know
-  the amount of such a `SETTLE`, as for `CONTRACT_BALANCE`, that `SETTLE` counts
-  as a later step's take. When an earlier step left ETH in the router, that ETH
-  may pay part of a `SETTLE` of ETH paid from the router. That `SETTLE` then
-  gets lines of its own, with `Up to` before its amount. A later take of
-  `Token In` that only the user's wallet pays is added to the total while both
-  are quantities: a V3 exact-in of 600 USDT and a V2 exact-in of 400 USDT, both
-  paid by the user, read `1000.0000 USDT`. When the decoder does not know a
-  take's amount, the total is not known and there is no `Amount` line. A
-  `PERMIT2_PERMIT` names `Token In` only when its amount, `Unlimited` included,
-  stands as the `Amount` figure in place of the total, which it does only in the
-  plain shape of Uniswap's own routes: it comes before the step that sets the
-  input side, it is the only `PERMIT2_PERMIT` in the transaction and there is no
-  `PERMIT2_PERMIT_BATCH`, its spender is the router, the router may not let it
-  fail, no step before it takes its token, a `PERMIT2_TRANSFER_FROM` of it
-  included, or a token the decoder does not know, and the decoder reads every
-  step after it in full. Permit2 then lets the router take no more of the token
-  than that amount, so the permit covers every take of it. A step before the
-  permit takes under whatever allowance the router already had, so it may take
-  more than the permit's amount, which would then read lower than what leaves
-  the user's wallet: a `PERMIT2_TRANSFER_FROM` of 2,000 USDT into the router,
-  then a permit of 600 USDT to the router and a V3 exact-in of 2,000 USDT paid
-  from the router, read `Amount 2000.0000 USDT`. A later permit or batch may
-  raise what Permit2 lets the router take, and so may a step the decoder does
-  not read in full: a command the decoder does not read (listed at the end of
-  this section), a step whose input it cannot read, in whole or in part, and a
-  step it fails on. Every other `PERMIT2_PERMIT`, before the step that sets the
-  input side or after it, leaves `Token In` and the `Amount` line as they read
-  with no permit, unless it lets a spender other than the router take `Token In`
-  (see below): a permit of 5,000 DAI to another address and then a V3 exact-in
-  of 600 USDT read `Swap USDT → USDC` with `Amount 600.0000 USDT`, and so do
-  that exact-in and then a permit of 5,000 DAI to the router. A permit on the
-  zero address never stands as the `Amount` figure, because Permit2 has no
-  allowance of ETH. When a permit's amount stands and the step that sets the
-  input side spends a token other than the permit's, or one the decoder does not
-  know, that step's amount gets lines of its own, unless it states no amount and
-  the user pays it none of its input token. Each take the total does not count
-  gives three lines after the `Amount` line (after `Token In` when there is
-  none): one of a token other than `Token In`; one of `Token In` after an amount
-  that is not a quantity (a V4 open delta, `ALREADY_PAID`, which keep their
-  wording on the `Amount` line, or no stated amount, as of a V4 exact-out step);
-  an ETH take whose line reads `Up to` (see above); and one whose amount the
-  decoder does not know. When there is no `Amount` line, each take the total
-  counts gets them too, so that every amount the decoder reads is shown: the
-  amount the step that sets the input side states, when it is a quantity and the
-  user pays that step (a V2 or V3 step whose `payerIsUser` is true, a V4 step
-  the user pays some of its input token, or a `WRAP_ETH`, whose ETH comes from
-  the transaction's value), and each later take of `Token In` added to it. A
-  step that sets the input side gets none when the user pays it none of its
-  input token. A `PERMIT2_PERMIT` the decoder cannot read, then V3 exact-ins of
-  600 USDT and 400 DAI paid by the user, give lines for both amounts. When the
-  step that sets the input side states no amount, the user pays it some of its
-  input token, and there is no `Amount` line, that step gets them too whenever
-  another take's lines give a figure, or a `PERMIT2_TRANSFER_FROM` of its token
-  gives one, on the lines below or, into the router, on its `Paid to` line, so
-  that figure cannot read as all that leaves. When it states no amount and the
-  user pays it none of its input token, that step never gets them, with a permit
-  or without. They come in step order, except that the step that sets the input
-  side comes first when it has them, followed, when there is no `Amount` line,
-  by the other takes the total counts: `Moved from the sender`, its amount,
-  worded as the `Amount` line words one, or `Unknown (could not be decoded)`
-  when the decoder does not know it; `Token moved`, giving the token's address
-  as the `Token In` line does; and `Moved to`, which reads
-  `The swap step that spends it`. A token the decoder does not know gives the
-  `Moved from the sender` line alone. A step may also take from the user's
-  wallet what the decoder did not read: a V4 step whose input or one of whose
-  `SETTLE`s or `SETTLE_ALL`s it cannot read, which the router still runs; a V2
-  or V3 exact-in or exact-out step or a `PERMIT2_TRANSFER_FROM` whose input it
-  cannot read, such as a V3 step whose path is shorter than one token address or
-  has bytes after its last hop; every `PERMIT2_TRANSFER_FROM_BATCH`; every
-  `EXECUTE_SUB_PLAN`, wherever it stands; and every step it fails on. Each such
-  step gives one `Moved from the sender` line among those, reading
-  `Unknown (could not be decoded)`. That line, or any line for a token the
-  decoder does not know, leaves no `Amount` line, whose figure might be too low,
-  and such a step before a `PERMIT2_PERMIT` keeps the permit's amount from
-  standing. Then each `PERMIT2_TRANSFER_FROM` but one into the router, in step
-  order, gives three lines: `Moved from the sender`, the amount it moves, for
-  example `1000000.0000 USDT`; `Token moved`, giving the token's address as the
-  `Token In` line does; and `Moved to`, which reads
+  rest taken to another address, reads `5000.0000 USDT`. A later step paid from
+  the router spends what the router holds and takes nothing, and so does a V2
+  exact-in whose `amountIn` is `ALREADY_PAID`. A later take of `Token In` is
+  added to the total while both are quantities: a V3 exact-in of 600 USDT and a
+  V2 exact-in of 400 USDT, both paid by the user, read `1000.0000 USDT`. When
+  the decoder does not know a take's amount, the total is not known and there is
+  no `Amount` line. A `PERMIT2_PERMIT` names `Token In` only when its amount,
+  `Unlimited` included, stands as the `Amount` figure in place of the total,
+  which it does only in the plain shape of Uniswap's own routes: it comes before
+  the step that sets the input side, it is the only `PERMIT2_PERMIT` in the
+  transaction and there is no `PERMIT2_PERMIT_BATCH`, its spender is the router,
+  its token is not the zero address, the router may not let it fail, no step
+  before it takes its token, a `PERMIT2_TRANSFER_FROM` of it included, or a
+  token the decoder does not know, and the decoder reads every step after it in
+  full. Permit2 then lets the router take no more of the token than that amount,
+  so the permit covers every take of it. Permit2 has no allowance of ETH, so a
+  permit on the zero address covers no take of ETH. A step before the permit
+  takes under whatever allowance the router already had, so it may take more
+  than the permit's amount, which would then read lower than what leaves the
+  user's wallet: a `PERMIT2_TRANSFER_FROM` of 2,000 USDT into the router, then a
+  permit of 600 USDT to the router and a V3 exact-in of 2,000 USDT paid from the
+  router, read `Amount 2000.0000 USDT`. A later permit or batch may raise what
+  Permit2 lets the router take, and so may a step the decoder does not read in
+  full: a command the decoder does not read (listed at the end of this section),
+  a step whose input it cannot read, in whole or in part, and a step it fails
+  on. Every other `PERMIT2_PERMIT`, before the step that sets the input side or
+  after it, leaves `Token In` and the `Amount` line as they read with no permit,
+  unless it lets a spender other than the router take `Token In` (see below): a
+  permit of 5,000 DAI to another address and then a V3 exact-in of 600 USDT read
+  `Swap USDT → USDC` with `Amount 600.0000 USDT`, and so do that exact-in and
+  then a permit of 5,000 DAI to the router. When a permit's amount stands and
+  the step that sets the input side spends a token other than the permit's, or
+  one the decoder does not know, that step's amount gets lines of its own,
+  unless it states no amount and the user pays it none of its input token. Each
+  take the total does not count gives three lines after the `Amount` line (after
+  `Token In` when there is none): one of a token other than `Token In`; one of
+  `Token In` after an amount that is not a quantity (a V4 open delta,
+  `ALREADY_PAID`, which keep their wording on the `Amount` line, or no stated
+  amount, as of a V4 exact-out step); and one whose amount the decoder does not
+  know. When there is no `Amount` line, each take the total counts gets them
+  too, so that every amount the decoder reads is shown: the amount the step that
+  sets the input side states, when it is a quantity and the user pays that step
+  (a V2 or V3 step whose `payerIsUser` is true, a V4 step the user pays some of
+  its input token, or a `WRAP_ETH`, whose ETH comes from the transaction's
+  value), and each later take of `Token In` added to it. A step that sets the
+  input side and is paid from the router takes nothing from the user's wallet
+  and gets none. A `PERMIT2_PERMIT` the decoder cannot read, then V3 exact-ins
+  of 600 USDT and 400 DAI paid by the user, give lines for both amounts. When
+  the step that sets the input side states no amount, the user pays it some of
+  its input token, and there is no `Amount` line, that step gets them too
+  whenever another take's lines give a figure, or a `PERMIT2_TRANSFER_FROM` of
+  its token gives one, on the lines below or, into the router, on its `Paid to`
+  line, so that figure cannot read as all that leaves. When it states no amount
+  and the user pays it none of its input token, as when the router pays it, that
+  step takes none of that token from the user's wallet and never gets them, with
+  a permit or without. They come in step order, except that the step that sets
+  the input side comes first when it has them, followed, when there is no
+  `Amount` line, by the other takes the total counts: `Moved from the sender`,
+  its amount, worded as the `Amount` line words one, or
+  `Unknown (could not be decoded)` when the decoder does not know it;
+  `Token moved`, giving the token's address as the `Token In` line does; and
+  `Moved to`, which reads `The swap step that spends it`. A token the decoder
+  does not know gives the `Moved from the sender` line alone. A step may also
+  take from the user's wallet what the decoder did not read: a V4 step whose
+  input or one of whose `SETTLE`s or `SETTLE_ALL`s it cannot read, which the
+  router still runs; a V2 or V3 exact-in or exact-out step or a
+  `PERMIT2_TRANSFER_FROM` whose input it cannot read, such as a V3 step whose
+  path is shorter than one token address or has bytes after its last hop; every
+  `PERMIT2_TRANSFER_FROM_BATCH`; every `EXECUTE_SUB_PLAN`, wherever it stands;
+  and every step it fails on. Each such step gives one `Moved from the sender`
+  line among those, reading `Unknown (could not be decoded)`. That line, or any
+  line for a token the decoder does not know, leaves no `Amount` line, whose
+  figure might be too low, and such a step before a `PERMIT2_PERMIT` keeps the
+  permit's amount from standing. Then each `PERMIT2_TRANSFER_FROM` but one into
+  the router, in step order, gives three lines: `Moved from the sender`, the
+  amount it moves, for example `1000000.0000 USDT`; `Token moved`, giving the
+  token's address as the `Token In` line does; and `Moved to`, which reads
   `The V2 pair the next swap spends` for a hop and `The sender` for `address(1)`
   on every router but `UniversalRouterV1`, and otherwise gives the address. A
   move into the router needs none of them, because its `Paid to` line and
   `Token moved into the router` line already give the amount, the token and
-  where it goes, and so its amount is shown once. For a move of the zero
-  address, `Moved from the sender` gives the amount in base units and
-  `Token moved` gives the zero address. For such a move into the router, the
-  `Paid to` line gives the amount in base units and
-  `Token moved into the router` gives the zero address. Every `PERMIT2_PERMIT`
-  whose amount does not stand as the `Amount` figure, before the step that sets
-  the input side or after it, gives three lines, in step order, after those for
-  each `PERMIT2_TRANSFER_FROM`: `Permit2 allowance`, its amount, for example
+  where it goes, and so its amount is shown once. Every `PERMIT2_PERMIT` whose
+  amount does not stand as the `Amount` figure, before the step that sets the
+  input side or after it, gives three lines, in step order, after those for each
+  `PERMIT2_TRANSFER_FROM`: `Permit2 allowance`, its amount, for example
   `5000.0000 DAI`, or `Unlimited` for Permit2's maximum; `Allowance token`,
   giving the token's address as the `Token In` line does; and
   `Allowance spender`, the address it lets take the token. Only a permit whose

docs/README.md

@@ -70,9 +70,9 @@ analytics, use a portfolio tracker. The wallet is not the place for any of that.
 ## How It Works
 
 AutistMask is a browser extension that runs entirely in your browser. It does
-not have a backend server. Out of the box it contacts only the Ethereum RPC
-endpoint. USD prices are read from Chainlink price feed contracts through that
-endpoint.
+not have a backend server. Out of the box it sends your data only to the
+Ethereum RPC endpoint. It also asks the CoinDesk price API for prices, sending
+token symbols and nothing else.
 
 Blockscout and Etherscan are sent none of your data until you turn on a setting
 for each. The settings are "Use Blockscout" and "Check recipients on Etherscan".
@@ -89,16 +89,10 @@ verify confirmations. The default is a free public RPC endpoint. You can change
 this in Settings to any Ethereum JSON-RPC endpoint, including your own local
 node.
 
-On mainnet, AutistMask also reads USD prices through this endpoint. The prices
-come from Chainlink's price feed contracts. A token with no Chainlink feed shows
-no USD value.
-
 When it is contacted:
 
 - on every balance refresh (every 10 seconds while the popup is open, every 60
   seconds in the background)
-- on mainnet, to read USD prices, at most every 5 minutes while the popup is
-  open
 - when you review a send to an ENS name
 - when a send is prepared and broadcast
 - while a pending transaction is polled for its receipt
@@ -137,6 +131,19 @@ sends none of your data.
 What gets sent: your Ethereum addresses (to look up balances and transactions)
 and the hash of each transaction you open.
 
+**CoinDesk CADLI price API** (`data-api.coindesk.com`)
+
+Used to fetch current USD prices for ETH and the top 25 tokens. Prices are
+cached for 5 minutes. No API key is required. This endpoint is not
+user-configurable, and it is not contacted at all while you are on a testnet,
+where no USD values are shown.
+
+When it is contacted: while the popup is open, at most once every 5 minutes.
+
+What gets sent: token symbol names (e.g. "ETH", "USDC"). No addresses, no
+balances, no identifying information. As with any request, CoinDesk sees your IP
+address.
+
 **Etherscan address labels** (`etherscan.io`; `sepolia.etherscan.io` on Sepolia)
 
 While "Check recipients on Etherscan" is on, AutistMask fetches the recipient's
@@ -377,15 +384,13 @@ point-in-time snapshot of the highest-market-cap Ethereum mainnet ERC-20s, fixed
 at build time and updated only when a new release ships a newer snapshot. If a
 transaction or balance claims to involve a known symbol (like "ETH" or "USDT")
 but comes from an unrecognized contract, it is identified as a spoof and hidden.
-On Sepolia, only "ETH" and "SepoliaETH" count as known symbols, because the
-bundled list holds Ethereum Mainnet tokens. In your transaction history the
-check is the "Hide fake tokens impersonating a known symbol" setting, which you
-can switch off; doing so also stops new entries being added to the fraud
-contract blocklist below, since detecting a spoof is what fills it. The send
-token list always applies the check. Your balances apply it too, with one
-exception: a token claiming the symbol "ETH" is not filtered there, so a fake
-"ETH" token can still show up in your balance list even though it is hidden from
-your transaction history and from the send token list.
+In your transaction history this is the "Hide fake tokens impersonating a known
+symbol" setting, which you can switch off; doing so also stops new entries being
+added to the fraud contract blocklist below, since detecting a spoof is what
+fills it. The send token list always applies the check. Your balances apply it
+too, with one exception: a token claiming the symbol "ETH" is not filtered
+there, so a fake "ETH" token can still show up in your balance list even though
+it is hidden from your transaction history and from the send token list.
 
 **Low-holder token filtering.** Tokens with fewer than 1,000 holders are hidden
 from transaction history and the send token list, and are left out of your

src/popup/index.js

@@ -65,14 +65,7 @@ function renderWalletList() {
 const pageClosed = new AbortController();
 window.addEventListener("pagehide", () => pageClosed.abort());
 
-// While a refresh runs, a request through ctx is not dropped. The request sets
-// refreshAgain, and one more refresh runs once the running one ends. Several
-// requests in that time lead to one more refresh, not several. An import asks
-// for a refresh after its address scan. A refresh already running does not
-// have the addresses the scan found
-// (https://git.eeqj.de/sneak/AutistMask/issues/581).
 let refreshInFlight = false;
-let refreshAgain = false;
 
 // The ten-second refresh startRefresh() starts, stopped when the popup moves to
 // the recovery screen: there is no profile left to refresh.
@@ -96,17 +89,14 @@ let refreshTimer = null;
 // user turned "Use Blockscout" off. So the save drops every token the user has
 // not tracked if the stored setting is off by then.
 async function doRefreshAndRender() {
-    if (refreshInFlight) {
-        refreshAgain = true;
-        return;
-    }
+    if (refreshInFlight) return;
     refreshInFlight = true;
     try {
         await followStoredSettings();
         const networkId = state.networkId;
         const wallets = structuredClone(state.wallets);
         await Promise.all([
-            refreshPrices(pageClosed.signal),
+            refreshPrices(),
             refreshBalances(
                 wallets,
                 state.rpcUrl,
@@ -142,35 +132,28 @@ async function doRefreshAndRender() {
         });
         renderWalletList();
     } catch (e) {
-        // No caller waits for this function, so it must never reject. An
-        // unhandled rejection reports nothing. The save inside it reports its
-        // own failure through onSaveFailure() (see src/shared/state.js); what
-        // is left here is a failed network round trip, which the next tick
-        // retries.
+        // Every call site fires this and walks away — the boot below, the ten
+        // second interval, and eight views through ctx — so it must never
+        // reject: an unhandled rejection is not a report of anything. The save
+        // inside it reports its own failure through onSaveFailure() (see
+        // src/shared/state.js); what is left here is a failed network round
+        // trip, which the next tick retries.
         log.errorf("popup: background refresh failed:", e);
     } finally {
         refreshInFlight = false;
     }
-    if (refreshAgain) {
-        refreshAgain = false;
-        doRefreshAndRender();
-    }
 }
 
 // Refreshes now and every ten seconds from then on. Called once a wallet
 // exists: by init() when the popup opens with one, and by AddWallet when it
 // adds one, which in a popup that opened on Welcome is the first
-// (https://git.eeqj.de/sneak/AutistMask/issues/530). With the ten-second
-// refresh already started, it starts no second one. On the recovery screen it
-// does nothing.
+// (https://git.eeqj.de/sneak/AutistMask/issues/530). With the refresh already
+// running it starts no second one, and on the recovery screen it does nothing.
 function startRefresh() {
     if (!$("view-state-recovery").classList.contains("hidden")) return;
     doRefreshAndRender();
     if (refreshTimer === null) {
-        // A tick that finds a refresh running is dropped.
-        refreshTimer = setInterval(() => {
-            if (!refreshInFlight) return doRefreshAndRender();
-        }, 10000);
+        refreshTimer = setInterval(doRefreshAndRender, 10000);
     }
 }
 

src/popup/views/addressToken.js

@@ -22,7 +22,7 @@ const {
     timeAgo,
 } = require("./helpers");
 const { state, saveState, currentNetwork } = require("../../shared/state");
-const { bundledToken, resolveSymbol } = require("../../shared/tokenList");
+const { TOKEN_BY_ADDRESS, resolveSymbol } = require("../../shared/tokenList");
 const { formatUsd, getPrice } = require("../../shared/prices");
 const {
     fetchRecentTransactions,
@@ -52,8 +52,7 @@ function show() {
 
     // Determine token symbol and balance
     let symbol, amount, price;
-    const chainId = currentNetwork().chainId;
-    const knownToken = bundledToken(tokenId, chainId);
+    const knownToken = TOKEN_BY_ADDRESS.get(tokenId.toLowerCase());
     if (tokenId === "ETH") {
         symbol = nativeCurrency();
         amount = parseFloat(addr.balance || "0");
@@ -66,12 +65,11 @@ function show() {
             tokenId,
             addr.tokenBalances,
             state.trackedTokens,
-            chainId,
         );
         // null when the scale is unknown: no quantity to show, and none to
         // price. balanceLine() states that rather than printing 0.0000.
         amount = tb ? unknownableAmount(tb.balance) : 0;
-        price = getPrice(tokenId);
+        price = getPrice(symbol);
     }
 
     currentSymbol = symbol;

src/popup/views/confirmTx.js

@@ -129,7 +129,7 @@ function renderAmount(txInfo) {
     const rawSymbol = isErc20
         ? txInfo.tokenSymbol || "?"
         : nativeCurrencyByChainId(txInfo.chainId);
-    const price = getPrice(txInfo.token, txInfo.chainId);
+    const price = getPrice(isErc20 ? rawSymbol : "ETH", txInfo.chainId);
     const amountUsd = price ? parseFloat(txInfo.amount) * price : null;
     $("confirm-amount").textContent = valueWithUsd(
         shownAmount(txInfo) + " " + displaySymbol(rawSymbol),
@@ -157,7 +157,7 @@ function renderBalance(txInfo) {
         $("confirm-balance").textContent = "unknown (" + symbol + ")";
         return;
     }
-    const price = getPrice(txInfo.token, txInfo.chainId);
+    const price = getPrice(isErc20 ? rawSymbol : "ETH", txInfo.chainId);
     const balUsd = price ? parseFloat(bal) * price : null;
     $("confirm-balance").textContent = valueWithUsd(
         truncateAmountNeverZero(bal) + " " + symbol,

src/popup/views/helpers.js

@@ -313,17 +313,14 @@ function nativeCurrency() {
 // The wallets' balances hold what Blockscout reported for each token. So the
 // wallets are returned only while "Use Blockscout" is on.
 function tokenSourcesByChainId(chainId) {
-    const chainIdOrActive = chainId || currentNetwork().chainId;
-    const net = networkByChainId(chainIdOrActive);
+    const net = chainId ? networkByChainId(chainId) : currentNetwork();
     if (net && net.id === state.networkId) {
         return {
-            chainId: chainIdOrActive,
             trackedTokens: state.trackedTokens,
             wallets: state.useBlockscout ? state.wallets : [],
         };
     }
     return {
-        chainId: chainIdOrActive,
         trackedTokens: (net && state.networkTrackedTokens[net.id]) || [],
         wallets: [],
     };
@@ -354,7 +351,7 @@ function blockscoutOffTokenNoteHtml(token, chainId) {
 
 // The symbol shown for a token line, from these sources in order:
 //
-// - the bundled list, for a token on Ethereum Mainnet
+// - the bundled list
 // - the tokens the user tracks
 // - the explorer's report, while "Use Blockscout" is on
 //
@@ -442,7 +439,7 @@ function balanceLinesForAddress(addr, trackedTokens, showZero) {
         html += balanceLine(
             t.symbol,
             bal,
-            getPrice(t.address),
+            getPrice(t.symbol),
             t.address.toLowerCase(),
         );
         seen.add(t.address.toLowerCase());
@@ -453,7 +450,7 @@ function balanceLinesForAddress(addr, trackedTokens, showZero) {
             html += balanceLine(
                 t.symbol,
                 0,
-                getPrice(t.address),
+                getPrice(t.symbol),
                 t.address.toLowerCase(),
             );
         }

src/popup/views/send.js

@@ -12,7 +12,7 @@ const {
     goBack,
     tokenSourcesByChainId,
 } = require("./helpers");
-const { state, currentAddress, currentNetwork } = require("../../shared/state");
+const { state, currentAddress } = require("../../shared/state");
 let ctx;
 const { getProvider } = require("../../shared/balances");
 const { resolveTokenDecimals } = require("../../shared/approvalAmount");
@@ -154,9 +154,7 @@ function renderSendTokenSelect(addr) {
         // out. Its token's own screen can still send it: there
         // state.selectedToken picks the token, not this list.
         if (isBelowOneMillionth(t.balance)) continue;
-        if (isSpoofedSymbol(t.symbol, t.address, currentNetwork().chainId)) {
-            continue;
-        }
+        if (isSpoofedSymbol(t.symbol, t.address)) continue;
         if (fraudSet.has(t.address.toLowerCase())) continue;
         // An unknown holder count does not withhold a token the user holds:
         // only a count the explorer actually reported as below the threshold
@@ -232,7 +230,6 @@ function updateSendBalance() {
             token,
             addr.tokenBalances,
             state.trackedTokens,
-            currentNetwork().chainId,
         );
         // A null balance is a holding whose scale is unknown. Saying a figure
         // for it would be a claim about the amount, so it reads as the
@@ -388,7 +385,6 @@ function init(_ctx) {
                 token,
                 addr.tokenBalances,
                 state.trackedTokens,
-                currentNetwork().chainId,
             );
             ({ tokenDecimals } = tokenBalanceAndDecimals(addr, token));
         }

src/popup/views/settings.js

@@ -44,12 +44,6 @@ let ctx;
 let versionClickCount = 0;
 let versionClickTimer = null;
 
-// The network that Settings was last drawn for. A follow of a switch saved
-// elsewhere sets `state` to the new network first. Settings is drawn again only
-// once the follow's write returns. So both "Save" buttons take this network,
-// not the one in `state`.
-let shownNetwork = null;
-
 // One row per site origin, however many addresses it appears under, each with
 // an [x] that hands it to onRemove.
 function renderSiteList(containerId, origins, onRemove) {
@@ -205,7 +199,6 @@ function renderWalletListSettings() {
 }
 
 function show() {
-    shownNetwork = currentNetwork();
     $("settings-rpc").value = state.rpcUrl;
     $("settings-blockscout").value = state.blockscoutUrl;
     $("settings-network").value = state.networkId;
@@ -313,7 +306,6 @@ function showNewSettings() {
         state.checkRecipientsOnEtherscan;
     if (state.currentView === "settings") {
         markViewRendered("settings");
-        shownNetwork = currentNetwork();
         $("settings-network").value = state.networkId;
         $("settings-rpc").value = state.rpcUrl;
         $("settings-blockscout").value = state.blockscoutUrl;
@@ -327,48 +319,6 @@ function showNewSettings() {
     updateDebugBanner(state.currentView);
 }
 
-// Saves `url` as `field` ("rpcUrl" or "blockscoutUrl") of the network
-// `networkId`, the one that Settings showed when the user tapped "Save". The
-// URL is set in `state` inside the save, holding the lock. So the page cannot
-// follow a switch saved elsewhere (followStoredSettings() in
-// src/popup/index.js) between setting the URL and writing it. If the active
-// network is no longer `networkId`, on this page or in the stored record,
-// nothing is saved. The flash message then says that the network changed.
-//
-// The save writes only the fields that differ from what this page last saved.
-// Another page may have stored a different URL since then. So `url` is set in
-// the stored record too. "Saved." then means that the stored record holds
-// `url`.
-//
-// `input` is the id of the input that the user typed `url` in. When another
-// page changes the network, "Use Blockscout" or "Check recipients on
-// Etherscan", this page draws Settings again. A redraw during the endpoint
-// check puts the URL from `state` back in the input. So if the input no longer
-// shows `url`, nothing is saved. The flash message then says that the URL was
-// changed during the check. The save compares the input and sets `url` in
-// `state` in one step. So a redraw after the comparison shows `url`.
-async function saveEndpoint(field, input, url, networkId) {
-    let refused = false;
-    let inputChanged = false;
-    await saveState((stored) => {
-        refused =
-            state.networkId !== networkId || stored.networkId !== networkId;
-        inputChanged = $(input).value.trim() !== url;
-        if (refused || inputChanged) return false;
-        state[field] = url;
-        stored[field] = url;
-    });
-    if (refused) {
-        showFlash("The URL was not saved because the network changed.");
-    } else if (inputChanged) {
-        showFlash(
-            "The URL was not saved because it was changed during the check.",
-        );
-    } else {
-        showFlash("Saved.");
-    }
-}
-
 function init(_ctx) {
     ctx = _ctx;
     deleteWallet.init(ctx);
@@ -380,8 +330,6 @@ function init(_ctx) {
             showFlash("Please enter an RPC URL.");
             return;
         }
-        // The URL is for the network that Settings shows when "Save" is tapped.
-        const net = shownNetwork;
         showFlash("Testing endpoint...");
         try {
             const resp = await debugFetch(url, {
@@ -400,6 +348,7 @@ function init(_ctx) {
                 showFlash("Endpoint returned an error.");
                 return;
             }
+            const net = currentNetwork();
             if (json.result !== net.chainId) {
                 showFlash("Wrong network: expected " + net.name + ".");
                 return;
@@ -415,7 +364,9 @@ function init(_ctx) {
             showFlash("Could not reach endpoint.");
             return;
         }
-        await saveEndpoint("rpcUrl", "settings-rpc", url, net.id);
+        state.rpcUrl = url;
+        await saveState();
+        showFlash("Saved.");
     });
 
     $("btn-save-blockscout").addEventListener("click", async () => {
@@ -424,7 +375,6 @@ function init(_ctx) {
             showFlash("Please enter a Blockscout API URL.");
             return;
         }
-        const net = shownNetwork;
         showFlash("Testing endpoint...");
         try {
             const resp = await debugFetch(url + "/stats");
@@ -439,7 +389,9 @@ function init(_ctx) {
             showFlash("Could not reach endpoint.");
             return;
         }
-        await saveEndpoint("blockscoutUrl", "settings-blockscout", url, net.id);
+        state.blockscoutUrl = url;
+        await saveState();
+        showFlash("Saved.");
     });
 
     // Each change is made inside the save, holding the lock. So

src/popup/views/transactionDetail.js

@@ -311,21 +311,10 @@ function populateOnChainDetails(txData, chainId) {
     }
 }
 
-// Whether TransactionDetail still holds the transaction with `txHash` on
-// `chainId`. Opening another transaction replaces the one TransactionDetail
-// holds. A visit to Settings does not.
-function holdsTransaction(txHash, chainId) {
-    const tx = state.viewData.tx;
-    return tx?.hash === txHash && tx?.chainId === chainId;
-}
-
 // Reads the block, network details and calldata from Blockscout, and decodes
 // the calldata. While the stored "Use Blockscout" is off, Blockscout is not
 // asked. An answer that lands after the setting went off is dropped
 // (src/shared/storedSettings.js). Either way none of them is shown.
-//
-// Blockscout can answer after the user has opened another transaction. That
-// answer is dropped.
 async function loadFullTxDetails(txHash, chainId) {
     if (!(await storedSettingIsOn("useBlockscout"))) return;
     const section = $("tx-detail-calldata-section");
@@ -344,7 +333,6 @@ async function loadFullTxDetails(txHash, chainId) {
         if (!resp.ok) return;
         const txData = await resp.json();
         if (!(await storedSettingIsOn("useBlockscout"))) return;
-        if (!holdsTransaction(txHash, chainId)) return;
 
         // Populate on-chain detail fields (block, nonce, gas, fee)
         populateOnChainDetails(txData, chainId);

src/shared/approvalAmount.js

@@ -29,7 +29,7 @@
 // string, and a token the user added by hand carries whatever lookupTokenInfo()
 // got back, so the accepted types are enumerated rather than coerced.
 const { toDecimals } = require("./transferAmount");
-const { bundledToken } = require("./tokenList");
+const { TOKEN_BY_ADDRESS } = require("./tokenList");
 const { isSpoofedSymbol } = require("./symbolSpoof");
 
 // Every decimals the explorer reported for this contract, across all the
@@ -53,14 +53,12 @@ function explorerDecimals(lower, wallets) {
 }
 
 // The decimals to render a token amount with, or null when nothing knows.
-// `sources` is { chainId, trackedTokens, wallets }. `chainId` is the chain id
-// of the token's network. The bundled list is read only when that network is
-// Ethereum Mainnet. `trackedTokens` and `wallets` are shaped as on `state`.
+// `sources` is { trackedTokens, wallets }, both shaped as they are on `state`.
 function resolveTokenDecimals(tokenAddress, sources) {
     const lower = (tokenAddress || "").toLowerCase();
     if (!lower) return null;
 
-    const bundled = bundledToken(lower, sources && sources.chainId);
+    const bundled = TOKEN_BY_ADDRESS.get(lower);
     if (bundled) {
         const d = toDecimals(bundled.decimals);
         if (d !== null) return d;
@@ -102,19 +100,18 @@ function explorerSymbol(lower, wallets) {
 // explorer reported: the same sources and the same precedence
 // resolveTokenDecimals() uses, so a token's name and its scale are drawn from
 // the same place and the two can no longer disagree about which sources they
-// trust. `sources` is as for resolveTokenDecimals().
+// trust. `sources` is { trackedTokens, wallets }, shaped as on `state`.
 //
 // A tracked or explorer-reported symbol is attacker-influenced text, so it is
-// held to the spoof rule (symbolSpoof.js): a candidate that the rule calls a
-// spoof is refused and the next source tried, so resolving a symbol never
-// becomes a new way to claim a known ticker. The bundled list is the wallet's
-// own data and is trusted as it is.
+// held to the spoof rule (symbolSpoof.js): a candidate that wears a bundled or
+// native ticker from a contract not entitled to it is refused and the next
+// source tried, so resolving a symbol never becomes a new way to claim a known
+// ticker. The bundled list is the wallet's own data and is trusted as it is.
 function resolveTokenSymbol(tokenAddress, sources) {
     const lower = (tokenAddress || "").toLowerCase();
     if (!lower) return null;
 
-    const chainId = sources && sources.chainId;
-    const bundled = bundledToken(lower, chainId);
+    const bundled = TOKEN_BY_ADDRESS.get(lower);
     if (bundled && bundled.symbol) return bundled.symbol;
 
     const tracked = ((sources && sources.trackedTokens) || []).find(
@@ -126,7 +123,7 @@ function resolveTokenSymbol(tokenAddress, sources) {
     if (reported) candidates.push(reported);
 
     for (const symbol of candidates) {
-        if (!isSpoofedSymbol(symbol, tokenAddress, chainId)) return symbol;
+        if (!isSpoofedSymbol(symbol, tokenAddress)) return symbol;
     }
     return null;
 }

src/shared/balances.js

@@ -17,7 +17,7 @@ const { ERC20_ABI } = require("./constants");
 const { NETWORKS } = require("./networks");
 const { log, debugFetch, urlOrigin } = require("./log");
 const { deriveAddressFromXpub } = require("./wallet");
-const { bundledToken } = require("./tokenList");
+const { TOKEN_BY_ADDRESS } = require("./tokenList");
 const { LOW_HOLDER_THRESHOLD, parseHoldersCount } = require("./holders");
 const { isSpoofedSymbol } = require("./symbolSpoof");
 const { toDecimals } = require("./transferAmount");
@@ -106,9 +106,6 @@ function rawUnits(value) {
 // balance is read through the RPC endpoint instead, and its row here gives that
 // entry its holder count and `decimals` (fetchTrackedTokenBalances()).
 //
-// `chainId` is the chain id of the network `blockscoutUrl` serves. The known
-// token list is used only when that network is Ethereum Mainnet.
-//
 // `decimals` and `balance` are each null when the answer is unknown, the same
 // way `holders` already is. Absence is never filled in here: this is the
 // upstream of every screen that displays a token amount, so a value invented
@@ -120,7 +117,6 @@ async function fetchTokenBalances(
     address,
     blockscoutUrl,
     trackedTokens,
-    chainId,
     signal,
 ) {
     if (!(await storedSettingIsOn("useBlockscout"))) return [];
@@ -179,10 +175,7 @@ async function fetchTokenBalances(
             // either way: copying another source into it would make
             // explorerDecimals()'s disagreement check compare something other
             // than explorer values.
-            const known = resolveTokenDecimals(tokenAddr, {
-                chainId,
-                trackedTokens,
-            });
+            const known = resolveTokenDecimals(tokenAddr, { trackedTokens });
             const scale = known !== null ? known : decimals;
             // null is a holding of an amount that cannot be stated, which is
             // not the same as a holding of zero, and must never render as one.
@@ -198,7 +191,7 @@ async function fetchTokenBalances(
             // through to the views, where the two low-holder filters treat
             // an unknown count as "do not judge" rather than as zero.
             const holders = parseHoldersCount(item.token.holders_count);
-            const isKnown = bundledToken(tokenAddr, chainId) !== null;
+            const isKnown = TOKEN_BY_ADDRESS.has(tokenAddr);
             const isTracked = trackedSet.has(tokenAddr);
             const hasEnoughHolders = holders >= LOW_HOLDER_THRESHOLD;
 
@@ -209,9 +202,7 @@ async function fetchTokenBalances(
             // Every row here is an ERC-20 the explorer reported, so it has a
             // contract address; the native ETH balance is fetched over RPC in
             // refreshBalances and never passes through this loop.
-            if (isSpoofedSymbol(item.token.symbol, tokenAddr, chainId)) {
-                continue;
-            }
+            if (isSpoofedSymbol(item.token.symbol, tokenAddr)) continue;
 
             balances.push({
                 address: item.token.address_hash,
@@ -258,18 +249,17 @@ async function fetchTokenBalances(
 // zero from the tracked list. A token whose symbol the spoof rule refuses gets
 // no entry either, as in fetchTokenBalances().
 //
-// `chainId` and `signal` are as for fetchTokenBalances().
+// `signal` is as for fetchTokenBalances().
 async function fetchTrackedTokenBalances(
     provider,
     address,
     trackedTokens,
     previous,
     explorerRequest,
-    chainId,
     signal,
 ) {
     const listed = trackedTokens.filter(
-        (token) => !isSpoofedSymbol(token.symbol, token.address, chainId),
+        (token) => !isSpoofedSymbol(token.symbol, token.address),
     );
     // Each token's balanceOf answer, or null where it failed.
     const balances = await Promise.all(
@@ -311,7 +301,7 @@ async function fetchTrackedTokenBalances(
         if (raw === 0n) return;
         const entry = entryIn(reported);
         const decimals = entry ? entry.decimals : null;
-        const known = resolveTokenDecimals(lower, { chainId, trackedTokens });
+        const known = resolveTokenDecimals(lower, { trackedTokens });
         const scale = known !== null ? known : decimals;
         rows.push({
             address: token.address,
@@ -340,7 +330,6 @@ async function refreshBalances(
 ) {
     log.debugf("refreshBalances start, rpc:", urlOrigin(rpcUrl));
     const provider = getProvider(rpcUrl, networkId);
-    const { chainId } = requireNetworkId(networkId);
     const tracked = trackedTokens || [];
     const trackedSet = new Set(tracked.map((t) => t.address.toLowerCase()));
     const updates = [];
@@ -404,7 +393,6 @@ async function refreshBalances(
                 addr.address,
                 blockscoutUrl,
                 tracked,
-                chainId,
                 signal,
             );
             updates.push(
@@ -415,7 +403,6 @@ async function refreshBalances(
                         tracked,
                         previous,
                         explorerRequest,
-                        chainId,
                         signal,
                     ),
                     explorerRequest,

src/shared/chainSwitch.js

@@ -47,43 +47,12 @@ function clearPopupCaches() {
 // lock, so it is never switched while a follow of a switch saved elsewhere
 // waits for the lock (followStoredSettings() in src/popup/index.js): that
 // follow runs first, and this switch is made after it.
-//
-// The save writes only the fields that differ from what this page last saved.
-// When this page last saved a balance of "0", clearing that balance is no
-// change. So the switch also resets these fields in the stored record:
-//
-// - every address's balance and token balances;
-// - the time of the last balance refresh;
-// - the fraud contracts.
-//
-// A balance or a fraud contract that the background or another page stored
-// since this page's last save is then not kept under the new network
-// (https://git.eeqj.de/sneak/AutistMask/issues/653,
-// https://git.eeqj.de/sneak/AutistMask/issues/692).
-//
-// Before the switch, `state` takes the tracked tokens that another page stored
-// since this page's last save (takeStoredTrackedTokens() in state.js). The
-// switch then puts them away under the previous network, the network they were
-// added on. When the stored record is on another network, a switch saved
-// elsewhere has not reached this page yet. The stored record's tokens are then
-// that network's, and none are taken.
 async function onChainSwitch(newNetworkId) {
-    const { state, saveState, takeStoredTrackedTokens } = require("./state");
+    const { state, saveState } = require("./state");
     let net = null;
-    await saveState((stored) => {
+    await saveState(() => {
         if (state.networkId === newNetworkId) return false;
-        if (stored.networkId === state.networkId) {
-            takeStoredTrackedTokens(stored);
-        }
         net = applyChainSwitchFields(state, newNetworkId);
-        stored.lastBalanceRefresh = 0;
-        stored.fraudContracts = [];
-        for (const wallet of stored.wallets) {
-            for (const addr of wallet.addresses) {
-                addr.balance = "0";
-                addr.tokenBalances = [];
-            }
-        }
         clearPopupCaches();
     });
     return net;

src/shared/prices.js

@@ -1,105 +1,31 @@
-// USD prices, read from Chainlink price feeds on Ethereum mainnet, with USD
-// formatting and value aggregation. The feeds are in src/shared/tokenList.js.
+// Price fetching with 5-minute cache, USD formatting, value aggregation.
 
-const { Contract } = require("ethers");
-const { ETH_USD_FEED, PRICE_FEED_BY_ADDRESS } = require("./tokenList");
-const { getProvider } = require("./balances");
+const { getTopTokenPrices } = require("./tokenList");
 const { isBelowOneMillionth } = require("./amountDisplay");
 const { networkByChainId } = require("./networks");
-const { log } = require("./log");
 
 const PRICE_CACHE_TTL = 300000; // 5 minutes
 
-// A reading older than its feed's heartbeat plus this many seconds is no price.
-const STALE_MARGIN = 1800; // 30 minutes
-
-const FEED_ABI = [
-    "function latestRoundData() view returns (uint80 roundId, int256 answer, uint256 startedAt, uint256 updatedAt, uint80 answeredInRound)",
-];
-
-// USD prices: ether's under "ETH", each token's under its lowercased contract
-// address.
 const prices = {};
 let lastFetchedAt = 0;
 
-// Reads the price of ether and of each token any address holds or the user
-// tracks, when that token has a feed. Mainnet only. The reads go to the RPC
-// endpoint as one batched request, at most every 5 minutes. A failed read is
-// logged, and that token then has no price.
-//
-// `signal`, passed by the popup, is aborted when the popup closes. A read that
-// fails once `signal` is aborted is not logged, because closing the popup
-// cancelled it.
-async function refreshPrices(signal) {
-    const { state, currentNetwork } = require("./state");
-    if (currentNetwork().id !== "mainnet") {
+async function refreshPrices() {
+    // Testnet tokens have no real market value — skip price fetching
+    // and clear any stale mainnet prices so the UI shows no USD values.
+    const { currentNetwork } = require("./state");
+    if (currentNetwork().isTestnet) {
         clearPrices();
         return;
     }
     const now = Date.now();
     if (now - lastFetchedAt < PRICE_CACHE_TTL) return;
-    const feeds = new Map([["ETH", ETH_USD_FEED]]);
-    for (const address of heldOrTrackedTokens(state)) {
-        const feed = PRICE_FEED_BY_ADDRESS.get(address);
-        if (feed) feeds.set(address, feed);
+    try {
+        const fetched = await getTopTokenPrices(25);
+        Object.assign(prices, fetched);
+        lastFetchedAt = now;
+    } catch {
+        // prices stay stale on error
     }
-    // ethers sends calls made together on one provider as one batch.
-    const provider = getProvider(state.rpcUrl, state.networkId);
-    const read = {};
-    await Promise.all(
-        [...feeds].map(async ([key, feed]) => {
-            try {
-                const contract = new Contract(feed.address, FEED_ABI, provider);
-                const round = await contract.latestRoundData();
-                const price = priceFromRound(round, feed, now);
-                if (price === null) {
-                    log.warnf(
-                        "price feed reading is stale or not positive",
-                        key,
-                    );
-                    return;
-                }
-                read[key] = price;
-            } catch (e) {
-                if (signal?.aborted) return;
-                log.errorf(
-                    "price feed read failed",
-                    key,
-                    e.shortMessage || e.message,
-                );
-            }
-        }),
-    );
-    clearPrices();
-    Object.assign(prices, read);
-    lastFetchedAt = now;
-}
-
-// The lowercased contract address of each token that any address holds or
-// that the user tracks.
-function heldOrTrackedTokens(state) {
-    const addresses = new Set();
-    for (const wallet of state.wallets) {
-        for (const addr of wallet.addresses) {
-            for (const token of addr.tokenBalances || []) {
-                addresses.add(token.address.toLowerCase());
-            }
-        }
-    }
-    for (const token of state.trackedTokens || []) {
-        addresses.add(token.address.toLowerCase());
-    }
-    return addresses;
-}
-
-// The USD price in a feed's latestRoundData() result, or null when the answer
-// is not positive or was written longer ago than the feed's heartbeat plus
-// STALE_MARGIN. `now` is in milliseconds.
-function priceFromRound(round, feed, now) {
-    const ageSeconds = now / 1000 - Number(round.updatedAt);
-    if (ageSeconds > feed.heartbeat + STALE_MARGIN) return null;
-    if (round.answer <= 0n) return null;
-    return Number(round.answer) / 10 ** feed.decimals;
 }
 
 // Clear all cached prices and reset the fetch timestamp so the
@@ -111,15 +37,14 @@ function clearPrices() {
     lastFetchedAt = 0;
 }
 
-// Return the USD price of the token at the contract address `token`, or of
-// ether when `token` is "ETH". The price is for the network with `chainId`, or
-// for the active network when no chain id is given. Returns null on testnet,
-// on a chain id that names no network, and for a token with no price.
-function getPrice(token, chainId) {
+// Return the USD price for a symbol on the network with `chainId`, or on the
+// active network when no chain id is given; null on testnet, on a chain id
+// that names no network, or for a symbol with no price.
+function getPrice(symbol, chainId) {
     const { currentNetwork } = require("./state");
     const network = chainId ? networkByChainId(chainId) : currentNetwork();
     if (!network || network.isTestnet) return null;
-    return prices[token === "ETH" ? "ETH" : token.toLowerCase()] || null;
+    return prices[symbol] || null;
 }
 
 function formatUsd(amount) {
@@ -137,7 +62,7 @@ function formatUsd(amount) {
 
 // What an address is worth, as { usd, partial }.
 //
-// Only a token with a price feed has a price, so an address can hold real
+// Prices are fetched for the top 25 tokens only, so an address can hold real
 // assets this code has no price for. Adding up the priced ones and calling the
 // result the total states a number the holdings do not support: an address
 // holding nothing but unpriced tokens comes out at $0.00, which tells the user
@@ -174,9 +99,8 @@ function getAddressValue(addr) {
         // nor make it incomplete. Anything that is not a number at all is not
         // a holding this can price either, and is left to the same rule.
         if (!(tokenBal > 0)) continue;
-        const price = prices[token.address.toLowerCase()];
-        if (price) {
-            usd += tokenBal * price;
+        if (prices[token.symbol]) {
+            usd += tokenBal * prices[token.symbol];
         } else {
             partial = true;
         }

src/shared/state.js

@@ -125,12 +125,11 @@ function currentNetwork() {
     return networkById(state.networkId);
 }
 
-// `baseline` holds the persisted fields as this page held them when its last
-// loadState() finished, or when its last successful saveState() began.
-// takeStoredNetwork() and takeStoredTrackedTokens() also write into it what
-// this page has taken from the stored record since then. saveState() diffs the
-// live state against `baseline` to find only the fields THIS page changed
-// since.
+// The persisted fields as this page held them when its last loadState()
+// finished, or when its last successful saveState() began, with any network
+// switch saved elsewhere that this page has taken since (takeStoredNetwork()).
+// saveState() diffs the live state against this to find only the fields THIS
+// page changed since.
 //
 // Deep-cloned, not a reference: callers mutate persisted objects and arrays
 // in place (state.wallets.push(...)), and a reference baseline would mutate
@@ -443,10 +442,8 @@ function mergeNetworkEndpoints(base, ours, theirs) {
 // milder than the other two.
 //
 // Every other persisted field stays a whole-field diff:
-// `fraudContracts`/`viewStack` are arrays of scalars with no per-element
-// identity to merge by; a save diffs `trackedTokens` whole, and a switch in
-// Settings first merges that list by contract address
-// (takeStoredTrackedTokens()); `networkTrackedTokens` is diffed whole like
+// `trackedTokens`/`fraudContracts`/`viewStack` are arrays of scalars with no
+// per-element identity to merge by; `networkTrackedTokens` is diffed whole like
 // `trackedTokens` and `networkId`, the two fields a network switch moves
 // together with it; `tokenHolderCache` is a map shaped like the ones above,
 // but nothing in src/ ever writes an entry into it — it is only ever reset
@@ -594,10 +591,8 @@ function reportSaveFailure(err) {
 //
 // `beforeWrite`, when given, is called inside the lock with the stored record
 // as just read, before this page's state is compared against it. It may change
-// `state`, and this save writes that change. It may also change the stored
-// record. A field that this page did not change is then written as
-// `beforeWrite` left it. When it returns false, nothing is written; any other
-// return lets the save go ahead.
+// `state`, and this save writes that change. When it returns false, nothing is
+// written; any other return lets the save go ahead.
 function saveState(beforeWrite) {
     const turn = withLock("autistmask", () => saveStateOnce(beforeWrite));
     // Every failed save is reported, whether or not the caller awaited this
@@ -618,28 +613,6 @@ function takeStoredNetwork(stored) {
     copyChainSwitchFields(baseline, structuredClone(stored));
 }
 
-// Give this page the tracked tokens of `stored`, a record on this page's
-// network that a save of this page has just read (onChainSwitch() in
-// src/shared/chainSwitch.js calls this from `beforeWrite`):
-//
-// - A token that another page tracked or removed since this page's last save
-//   is tracked or removed in `state` too.
-// - A token that this page tracked or removed since then stays as this page
-//   has it.
-//
-// `baseline` takes the stored list, so the save stores the list in `state`
-// whenever the two differ.
-function takeStoredTrackedTokens(stored) {
-    rawState.trackedTokens = mergeListByIdentity(
-        baseline.trackedTokens,
-        rawState.trackedTokens,
-        stored.trackedTokens,
-        (token) => token.address.toLowerCase(),
-        (base, ours) => ours,
-    );
-    baseline.trackedTokens = structuredClone(stored.trackedTokens);
-}
-
 // Rejects with StateUnusableError for a stored record this build cannot make
 // sense of. Nothing is assigned and `loaded` stays false in that case, so a
 // caller that ignores the rejection gets StateNotLoadedError on the first
@@ -686,7 +659,6 @@ module.exports = {
     saveState,
     onSaveFailure,
     takeStoredNetwork,
-    takeStoredTrackedTokens,
     loadState,
     currentAddress,
     currentNetwork,

src/shared/symbolSpoof.js

@@ -19,8 +19,7 @@
 // them hid the other one's holders' money (issue #276).  Membership, not
 // equality, is therefore the question — but it is the same question, asked of
 // a table that can now state the truth.  Every address in a set is one the
-// wallet ships as a real token on Ethereum Mainnet.  On mainnet, a contract
-// outside the set is still a spoof.
+// wallet ships as a real token; a contract outside the set is still a spoof.
 //
 // The symbol is attacker-controlled — it is whatever the ERC-20 contract
 // returns — so the lookup is done on a normalized form (issue #260): the
@@ -28,7 +27,6 @@
 // since that is what the user acts on.
 
 const { KNOWN_SYMBOLS } = require("./tokenList");
-const { NETWORKS } = require("./networks");
 
 // Ethereum addresses are case-insensitive: EIP-55 mixed case is a checksum
 // over the address, not part of its identity.
@@ -95,24 +93,18 @@ function normalizeSymbol(symbol) {
 }
 
 // True when a token bearing `symbol` from contract `contractAddress` is
-// impersonating a known symbol. `chainId` is the chain id of the token's
-// network.
-//
-// The native asset's labels are known symbols on every network. The bundled
-// list's symbols are known symbols only on Ethereum Mainnet, because the list
-// holds mainnet contracts.
+// impersonating a known symbol.
 //
 // An empty contract address is the native asset, which is never a spoof:
 // this is what keeps the user's real ETH out of the rule, and it holds for
 // any symbol that becomes null-mapped later, not just for ETH.
-function isSpoofedSymbol(symbol, contractAddress, chainId) {
+function isSpoofedSymbol(symbol, contractAddress) {
     const contract = normalizeAddress(contractAddress);
     if (!contract) return false;
     const sym = normalizeSymbol(symbol);
     if (!KNOWN_SYMBOLS.has(sym)) return false;
     const legit = KNOWN_SYMBOLS.get(sym);
     if (legit === null) return true;
-    if (chainId !== NETWORKS.mainnet.chainId) return false;
     return !legit.has(contract);
 }
 

src/shared/tokenList.js

@@ -4,12 +4,12 @@
 // Addresses are EIP-55 checksummed.
 //
 // 511 tokens.
-//
-// Below the list, USD_PRICE_FEEDS gives the Chainlink USD price feed of each
-// token that has one.
 
+const { debugFetch } = require("./log");
 const { NETWORKS } = require("./networks");
 
+const COINDESK_API = "https://data-api.coindesk.com/index/cc/v1/latest/tick";
+
 const TOKENS = [
     {
         address: "0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2",
@@ -3597,351 +3597,6 @@ const TOKENS = [
     },
 ];
 
-// Chainlink price feeds on Ethereum mainnet. Each feed is a contract whose
-// latestRoundData() returns a USD price and the time the price was written.
-// The fields of a feed:
-//
-//   - address: the feed's contract
-//   - heartbeat: the most seconds the feed goes without a new price
-//   - decimals: the number of decimal places in the price
-//
-// Each feed's address and heartbeat come from Chainlink's published list of
-// mainnet feeds. Each feed was checked on mainnet by reading its description()
-// and decimals().
-
-// The ETH/USD feed, which prices ether and WETH.
-const ETH_USD_FEED = {
-    address: "0x5f4eC3Df9cbd43714FE2740f5E3616155c5b8419",
-    heartbeat: 3600,
-    decimals: 8,
-};
-
-// The USD feed of each token in TOKENS that has one, keyed by the token's
-// contract address as TOKENS spells it. A token is paired with its feed by its
-// address alone, so a token that copies a listed token's symbol gets no feed.
-const USD_PRICE_FEEDS = {
-    // WETH
-    "0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2": ETH_USD_FEED,
-    // USDT
-    "0xdAC17F958D2ee523a2206206994597C13D831ec7": {
-        address: "0x3E7d1eAB13ad0104d2750B8863b489D65364e32D",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // BNB
-    "0xB8c77482e45F1F44dE1745F52C74426C631bDD52": {
-        address: "0x14e613AC84a31f709eadbdF89C6CC390fDc9540A",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // USDC
-    "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48": {
-        address: "0x8fFfFfd4AfB6115b954Bd326cbe7B4BA576818f6",
-        heartbeat: 82800,
-        decimals: 8,
-    },
-    // USDS
-    "0xdC035D45d973E3EC169d2276DDab16f1e407384F": {
-        address: "0xfF30586cD0F29eD462364C7e81375FC0C71219b1",
-        heartbeat: 82800,
-        decimals: 8,
-    },
-    // LINK
-    "0x514910771AF9Ca656af840dff83E8264EcF986CA": {
-        address: "0x2c1d072e956AFFC0D435Cb7AC38EF18d24d9127c",
-        heartbeat: 3600,
-        decimals: 8,
-    },
-    // USDE
-    "0x4c9EDD5852cd905f086C759E8383e09bff1E68B3": {
-        address: "0xa569d910839Ae8865Da8F8e70FfFb0cBA869F961",
-        heartbeat: 82800,
-        decimals: 8,
-    },
-    // USD1
-    "0x8d0D000Ee44948FC98c9B98A4FA4921476f08B0d": {
-        address: "0xF0d9bb015Cd7BfAb877B7156146dc09Bf461370d",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // DAI
-    "0x6B175474E89094C44Da98b954EedeAC495271d0F": {
-        address: "0xAed0c38402a5d19df6E4c03F4E2DceD6e29c1ee9",
-        heartbeat: 3600,
-        decimals: 8,
-    },
-    // PYUSD
-    "0x6c3ea9036406852006290770BEdFcAbA0e23A0e8": {
-        address: "0x8f1dF6D7F2db73eECE86a18b4381F4707b918FB1",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // WLFI
-    "0xdA5e1988097297dCdc1f90D4dFE7909e847CBeF6": {
-        address: "0x14E5FC91Ddb3f97C33013Cc9fA74F54062Ad1Aa1",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // UNI
-    "0x1f9840a85d5aF5bf1D1762F925BDADdC4201F984": {
-        address: "0x553303d460EE0afB37EdFf9bE42922D8FF63220e",
-        heartbeat: 3600,
-        decimals: 8,
-    },
-    // PAXG
-    "0x45804880De22913dAFE09f4980848ECE6EcbAf78": {
-        address: "0x9944D86CEB9160aF5C5feB251FD671923323f8C3",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // AAVE
-    "0x7Fc66500c84A76Ad7e9c93437bFc5Ac33E2DDaE9": {
-        address: "0x547a514d5e3769680Ce22B2361c10Ea13619e8a9",
-        heartbeat: 3600,
-        decimals: 8,
-    },
-    // USDF
-    "0xFa2B947eEc368f42195f24F36d2aF29f7c24CeC2": {
-        address: "0xb177857a1799aA5F7fEb5799Fdf12CbE8fdF78B1",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // USDG
-    "0xe343167631d89B6Ffc58B88d6b7fB0228795491D": {
-        address: "0x14f0737d6b705259e521EA6E9E3506AC78dBd311",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // SKY
-    "0x56072C95FAA701256059aa122697B133aDEd9279": {
-        address: "0xee10fE5E7aa92dd7b136597449c3d5813cFC5F18",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // RLUSD
-    "0x8292Bb45bf1Ee4d140127049757C2E0fF06317eD": {
-        address: "0x26C46B7aD0012cA71F2298ada567dC9Af14E7f2A",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // USDTB
-    "0xC139190F447e929f090Edeb554D95AbB8b18aC1C": {
-        address: "0x66704DAD467A7cA508B3be15865D9B9F3E186c90",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // ARB
-    "0xB50721BCf8d664c30412Cfbc6cf7a15145234ad1": {
-        address: "0x31697852a68433DbCc2Ff612c516d69E3D9bd08F",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // USD0
-    "0x73A15FeD60Bf67631dC6cd7Bc5B6e8da8190aCF5": {
-        address: "0x7e891DEbD8FA0A4Cf6BE58Ddff5a8ca174FebDCB",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // GHO
-    "0x40D16FC0246aD3160Ccc09B8D0D3A2cD28aE6C2f": {
-        address: "0x3f12643D3f6f874d39C2a4c9f2Cd6f2DbAC877FC",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // TUSD
-    "0x0000000000085d4780B73119b644AE5ecd22b376": {
-        address: "0xec746eCF986E2927Abd291a2A1716c940100f8Ba",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // EURC
-    "0x1aBaEA1f7C830bD89Acc67eC4af516284b1bC33c": {
-        address: "0x04F84020Fdf10d9ee64D1dcC2986EDF2F556DA11",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // FDUSD
-    "0xc5f0f7b66764F6ec8C8Dff7BA683102295E16409": {
-        address: "0xfAA9147190c2C2cc5B8387B4f49016bDB3380572",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // CRV
-    "0xD533a949740bb3306d119CC777fa900bA034cd52": {
-        address: "0xCd627aA160A6fA45Eb793D19Ef54f5062F20f33f",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // GRT
-    "0xc944E90C64B2c07662A292be6244BDf05Cda44a7": {
-        address: "0x86cF33a451dE9dc61a2862FD94FF4ad4Bd65A5d2",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // CRVUSD
-    "0xf939E0A03FB07F59A73314E73794Be0E57ac1b4E": {
-        address: "0xEEf0C605546958c1f899b6fB336C20671f9cD49F",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // FRAX, the Legacy Frax Dollar, priced by Chainlink's FRAX / USD feed
-    "0x853d955aCEf822Db058eb8505911ED77F175b99e": {
-        address: "0xB9E1E3A9feFf48998E45Fa90847ed4D467E8BcfD",
-        heartbeat: 3600,
-        decimals: 8,
-    },
-    // ENS
-    "0xC18360217D8F7Ab5e7c516566761Ea12Ce7F9D72": {
-        address: "0x5C00128d4d1c2F4f652C267d7bcdD7aC99C16E16",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // SAND
-    "0x3845badAde8e6dFF049820680d1F14bD3903a5d0": {
-        address: "0x35E3f7E558C04cE7eEE1629258EcbbA03B36Ec56",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // AUSD
-    "0x00000000eFE302BEAA2b3e6e1b18d08D69a9012a": {
-        address: "0xB00341502DfEA6Ced8A5786b4059d29dA5E4D1FD",
-        heartbeat: 86400,
-        decimals: 18,
-    },
-    // COMP
-    "0xc00e94Cb662C3520282E6f5717214004A7f26888": {
-        address: "0xdbd020CAeF83eFd542f4De03e3cF0C28A4428bd5",
-        heartbeat: 3600,
-        decimals: 8,
-    },
-    // XCN
-    "0xA2cd3D43c775978A96BdBf12d733D5A1ED94fb18": {
-        address: "0xeb988B77b94C186053282BfcD8B7ED55142D3cAB",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // CVX
-    "0x4e3FBD56CD56c3e72c1403e103b45Db9da5B9D2B": {
-        address: "0xd962fC30A72A84cE50161031391756Bf2876Af5D",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // IMX
-    "0xF57e7e7C23978C3cAEC3C3548E3D615c346e79fF": {
-        address: "0xBAEbEFc1D023c0feCcc047Bff42E75F15Ff213E6",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // 1INCH
-    "0x111111111117dC0aa78b770fA6A738034120C302": {
-        address: "0xc929ad75B72593967DE83E7F7Cda0493458261D9",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // SNX
-    "0xC011a73ee8576Fb46F5E1c5751cA3B9Fe0af2a6F": {
-        address: "0xDC3EA94CD0AC27d9A86C180091e7f78C683d3699",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // DOLA
-    "0x865377367054516e17014CcdED1e7d814EDC9ce4": {
-        address: "0xE33592594f72Cc7ec8a05788be8E8455746C3a32",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // FRXUSD
-    "0xCAcd6fd266aF91b8AeD52aCCc382b4e165586E29": {
-        address: "0x9B4a96210bc8D9D55b1908B465D8B0de68B7fF83",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // YFI
-    "0x0bc529c00C6401aEF6D220BE8C6Ea1667F6Ad93e": {
-        address: "0xA027702dbb89fbd58938e4324ac03B58d812b0E1",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // RSR
-    "0x320623b8E4fF03373931769A31Fc52A4E78B5d70": {
-        address: "0x759bBC1be8F90eE6457C44abc7d443842a976d02",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // ZRX
-    "0xE41d2489571d322189246DaFA5ebDe1F4699F498": {
-        address: "0x2885d15b8Af22648b98B122b22FDF4D2a56c6023",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // FRAX, formerly FXS, priced by Chainlink's FXS / USD feed
-    "0x3432B6A60D23Ca0dFCa7761B7ab56459D9C964D0": {
-        address: "0x6Ebc52C8C1089be9eB3945C4350B68B8E4C2233f",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // SXT
-    "0xE6Bfd33F52d82Ccb5b37E16D3dD81f9FFDAbB195": {
-        address: "0x2D27d9e1b74936D8E83c4BA118F09A4c4a897f62",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // SUSHI
-    "0x6B3595068778DD592e39A122f4f5a5cF09C90fE2": {
-        address: "0xCc70F09A6CC17553b2E31954cD36E4A2d89501f7",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // RPL
-    "0xD33526068D116cE69F19A9ee46F0bd304F21A51f": {
-        address: "0x4E155eD98aFE9034b7A5962f6C84c86d869daA9d",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // USDP
-    "0x8E870D67F660D95d5be530380D0eC0bd388289E1": {
-        address: "0x09023c0DA49Aaf8fc3fA3ADF34C6A7016D38D5e3",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // SPELL
-    "0x090185f2135308BaD17527004364eBcC2D37e5F6": {
-        address: "0x8c110B94C5f1d347fAcF5E1E938AB2db60E3c9a8",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // LUSD
-    "0x5f98805A4E8be255a32880FDeC7F6728C6568bA0": {
-        address: "0x3D7aE7E594f2f2091Ad8798313450130d0Aba3a0",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // STG
-    "0xAf5191B0De278C7286d6C7CC6ab6BB8A73bA2Cd6": {
-        address: "0x7A9f34a0Aa917D438e9b6E630067062B7F8f6f3d",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // KNC
-    "0xdeFA4e8a7bcBA345F687a2f1456F5Edd9CE97202": {
-        address: "0xf8fF43E991A81e6eC886a3D281A2C6cC19aE70Fc",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-    // MUSD (the other MUSD in TOKENS has no feed)
-    "0xacA92E438df0B2401fF60dA7E4337B687a2435DA": {
-        address: "0xc90E3460424fb8ea79775089E9053113FEE34Ed0",
-        heartbeat: 86400,
-        decimals: 8,
-    },
-};
-
-// Build a map of token address (lowercased) -> its USD price feed.
-const PRICE_FEED_BY_ADDRESS = new Map();
-for (const [address, feed] of Object.entries(USD_PRICE_FEEDS)) {
-    PRICE_FEED_BY_ADDRESS.set(address.toLowerCase(), feed);
-}
-
 // Return the top N tokens from the list.
 function getTopTokens(n) {
     return TOKENS.slice(0, n);
@@ -3953,15 +3608,6 @@ for (const t of TOKENS) {
     TOKEN_BY_ADDRESS.set(t.address.toLowerCase(), t);
 }
 
-// The bundled list's entry for the contract at `address` on the network with
-// chain id `chainId`, or null. The list holds Ethereum Mainnet contracts only.
-// A contract at the same address on another network is another token, so any
-// other chain id gets null.
-function bundledToken(address, chainId) {
-    if (chainId !== NETWORKS.mainnet.chainId) return null;
-    return TOKEN_BY_ADDRESS.get((address || "").toLowerCase()) || null;
-}
-
 // Build a map of symbol (uppercased) -> the set of contract addresses
 // (lowercased) that legitimately bear it.  Used for spoofed-symbol detection.
 // "ETH" maps to null: the native asset has no contract, so no contract may
@@ -3978,8 +3624,7 @@ function bundledToken(address, chainId) {
 // hides from the balance list, the history and the send selector at its own
 // address, so the user cannot spend it (issue #276).  Naming every address
 // that bears the symbol is the only shape that says what is true; it does not
-// loosen the rule.  On Ethereum Mainnet, a contract outside the set is still a
-// spoof.
+// loosen the rule, because a contract outside the set is still a spoof.
 const KNOWN_SYMBOLS = new Map();
 KNOWN_SYMBOLS.set("ETH", null);
 for (const network of Object.values(NETWORKS)) {
@@ -3998,15 +3643,41 @@ for (const t of TOKENS) {
     }
 }
 
-// Resolve a token symbol from multiple sources, never returning "?". The token
-// is a contract on the network with chain id `chainId`.
-function resolveSymbol(tokenAddress, tokenBalances, trackedTokens, chainId) {
+// Fetch USD prices for the top N tokens from CoinDesk.
+// Also always includes ETH. Returns { ETH: 1234.56, LINK: 8.60, ... }.
+// n must be <= 30 (API and sanity limit).
+async function getTopTokenPrices(n) {
+    if (n > 30) {
+        throw new Error("getTopTokenPrices: n must be <= 30, got " + n);
+    }
+    const symbols = ["ETH", ...TOKENS.slice(0, n).map((t) => t.symbol)];
+    const unique = [...new Set(symbols)];
+    const instruments = unique.map((s) => s + "-USD").join(",");
+    const url =
+        COINDESK_API +
+        "?market=cadli&instruments=" +
+        instruments +
+        "&apply_mapping=true";
+    const resp = await debugFetch(url);
+    const json = await resp.json();
+    const prices = {};
+    for (const [instrument, data] of Object.entries(json.Data || {})) {
+        const symbol = instrument.split("-")[0];
+        if (data.VALUE !== undefined) {
+            prices[symbol] = data.VALUE;
+        }
+    }
+    return prices;
+}
+
+// Resolve a token symbol from multiple sources, never returning "?".
+function resolveSymbol(tokenAddress, tokenBalances, trackedTokens) {
     const lower = (tokenAddress || "").toLowerCase();
     const tb = (tokenBalances || []).find(
         (t) => t.address.toLowerCase() === lower,
     );
     if (tb && tb.symbol) return tb.symbol;
-    const known = bundledToken(lower, chainId);
+    const known = TOKEN_BY_ADDRESS.get(lower);
     if (known && known.symbol) return known.symbol;
     const tracked = (trackedTokens || []).find(
         (t) => t.address.toLowerCase() === lower,
@@ -4019,10 +3690,7 @@ module.exports = {
     TOKENS,
     TOKEN_BY_ADDRESS,
     KNOWN_SYMBOLS,
-    ETH_USD_FEED,
-    USD_PRICE_FEEDS,
-    PRICE_FEED_BY_ADDRESS,
     getTopTokens,
-    bundledToken,
+    getTopTokenPrices,
     resolveSymbol,
 };

src/shared/transactions.js

@@ -8,7 +8,7 @@
 
 const { formatEther, formatUnits } = require("ethers");
 const { log, debugFetch } = require("./log");
-const { bundledToken } = require("./tokenList");
+const { TOKEN_BY_ADDRESS } = require("./tokenList");
 const { parseHoldersCount, isLowHolderCount } = require("./holders");
 const { isSpoofedSymbol } = require("./symbolSpoof");
 const { nativeCurrencyByChainId } = require("./networks");
@@ -47,7 +47,7 @@ function parseTx(tx, addrLower, chainId) {
     let direction = normalizeAddress(from) === addrLower ? "sent" : "received";
     let directionLabel = direction === "sent" ? "Sent" : "Received";
     if (toIsContract && method && method !== "transfer") {
-        const token = bundledToken(to, chainId);
+        const token = TOKEN_BY_ADDRESS.get(normalizeAddress(to));
         if (token) {
             symbol = token.symbol;
         }
@@ -317,10 +317,7 @@ function filterTransactions(txs, filters = {}) {
         const contract = normalizeAddress(tx.contractAddress);
 
         // Filter spoofed known symbols and record the fraud contract
-        if (
-            hideSpoofed &&
-            isSpoofedSymbol(tx.symbol, tx.contractAddress, tx.chainId)
-        ) {
+        if (hideSpoofed && isSpoofedSymbol(tx.symbol, tx.contractAddress)) {
             if (contract && !fraudSet.has(contract)) {
                 fraudSet.add(contract);
                 newFraud.push(contract);

src/shared/uniswap.js

@@ -452,8 +452,8 @@ const ADDRESS_THIS = "0x0000000000000000000000000000000000000002";
 // `decimals` is null when nothing knows this token's scale. It is not
 // defaulted to 18: the swap lines land on the same approval screen as the
 // ERC-20 line, and a scale guessed there is what showed a 1,000 USDT swap as
-// 0.000000000001. `sources` is as for resolveTokenDecimals(), which reads the
-// bundled list on Ethereum Mainnet, then the tracked tokens and the wallets.
+// 0.000000000001. `sources` is { trackedTokens, wallets }, shaped as they are
+// on `state`; resolveTokenDecimals() reads the bundled list, then those.
 //
 // A null `address` means UNDETERMINED — the calldata named no currency for
 // that side — and is refused rather than named. It is not native ETH: Uniswap
@@ -479,17 +479,6 @@ function tokenInfo(address, sources) {
     };
 }
 
-// The token of a Permit2 allowance or of a PERMIT2_TRANSFER_FROM, in the
-// shape tokenInfo() gives. Permit2 has no allowance of ETH and moves no ETH.
-// The zero address there reads as a token nothing knows: its amount in base
-// units, and the zero address as its token.
-function permit2TokenInfo(address, sources) {
-    if (address === "0x0000000000000000000000000000000000000000") {
-        return { symbol: null, decimals: null, address };
-    }
-    return tokenInfo(address, sources);
-}
-
 // A swap amount line. With a scale it is the token quantity; with none it is
 // the base-unit integer with the unknown scale stated, the same refusal the
 // ERC-20 amount line makes, so the screen has one way of saying it. `display`
@@ -508,18 +497,16 @@ function amountText(raw, info) {
 
 // The line giving a moved token, or the token of a permit, under `label`, in
 // the shape of the Token In line, so the screens show it as they show that
-// one. `info` is what tokenInfo() or permit2TokenInfo() gives for the token.
-// ETH has no address.
-function tokenMovedLine(label, info) {
+// one. ETH has no address.
+function tokenMovedLine(label, token, sources) {
+    const info = tokenInfo(token, sources);
     if (!present(info.address)) {
         return { label, value: info.symbol };
     }
     return {
         label,
-        value: info.symbol
-            ? info.symbol + " (" + info.address + ")"
-            : info.address,
-        address: info.address,
+        value: info.symbol ? info.symbol + " (" + token + ")" : token,
+        address: token,
         isToken: true,
     };
 }
@@ -1240,9 +1227,6 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
     const release = routerRelease(toAddress, chainId);
     if (release === null) return null;
     const { commandTypeMask, commands, allowRevert } = release;
-    // The swap's tokens are contracts on the network with `chainId`, so they
-    // are named and scaled for that network.
-    const tokenSources = { ...sources, chainId };
     try {
         const parsed = ROUTER_IFACE.parseTransaction({ data });
         if (!parsed) return null;
@@ -1256,10 +1240,9 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
         let inputEstablished = false;
         // Whether the user pays the step that set the input side: a V2 or V3
         // swap step with `payerIsUser` true, a V4 step the user pays some of
-        // its input currency (see paidByUser in the loop), or a WRAP_ETH,
-        // whose ETH comes from the transaction's value. A step that pays an
-        // ERC-20 token from the router takes none of that token from the
-        // sender.
+        // its input currency (see decodeV4Swap()), or a WRAP_ETH, whose ETH
+        // comes from the transaction's value. A step paid from the router
+        // takes nothing from the sender.
         let inputPaidByUser = false;
         // The last PERMIT2_PERMIT this decoder read before a step set the
         // input side, or null (see permitStands after the loop).
@@ -1355,9 +1338,7 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
         // What the steps take from the sender beyond the amount of the step
         // that sets the input side, as { token, amount }, in step order.
         // After the loop each joins the Amount line or gets lines of its own
-        // (see permitStands). A take with `atMost` set may take less than
-        // `amount`: it never joins the Amount line, and its line reads
-        // "Up to" and the amount.
+        // (see permitStands).
         const userPaid = [];
         // A swap step the user pays for (`payerIsUser` true) takes `amount`
         // of `token` from the sender. A V2 exact-in of ALREADY_PAID takes
@@ -1632,13 +1613,13 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
                     } else {
                         // The router passes this check whenever the owner
                         // holds at least minBalance, so a zero one guarantees
-                        // nothing. A check the router lets fail guarantees
-                        // nothing either, so it is read as a zero one. A zero
-                        // check sets neither Token Out nor the minimum. Any
+                        // nothing and does not replace a minimum an earlier
+                        // step stated. A check the router lets fail guarantees
+                        // nothing either, so it is read as a zero one. Any
                         // other minBalance sets the output side as a swap
-                        // does. The check pays nobody.
+                        // does. It pays nobody.
                         const minBalance = allowedToFail ? 0n : b.minBalance;
-                        if (minBalance !== 0n) {
+                        if (!(minBalance === 0n && present(minOutput))) {
                             setOutput(i, b.token, minBalance, []);
                         }
                         keepsRouterWeth = true;
@@ -1834,41 +1815,6 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
                 } else if (command === "V4_SWAP") {
                     const v4 = decodeV4Swap(inputs[i]);
                     const inputSetBefore = inputEstablished;
-                    // V4Router pays a SETTLE of ETH from the router's own
-                    // ETH, whichever payer the SETTLE names. The router holds
-                    // the transaction's value, and any ETH an earlier step
-                    // left it (see heldByRouter). So the user also pays a
-                    // SETTLE of ETH that names the router as payer. The user
-                    // pays all of its amount when the router holds no other
-                    // ETH, and up to its amount otherwise. CONTRACT_BALANCE
-                    // pays all the router holds, an amount the calldata does
-                    // not state.
-                    const routerHeldEth = heldByRouter.has(
-                        "0x0000000000000000000000000000000000000000",
-                    );
-                    const ethFromRouter = (v4?.settledFromRouter ?? [])
-                        .filter(
-                            (s) =>
-                                s.currency ===
-                                "0x0000000000000000000000000000000000000000",
-                        )
-                        .map((s) => ({
-                            currency: s.currency,
-                            amount:
-                                s.amount === CONTRACT_BALANCE ? null : s.amount,
-                        }));
-                    // What the user pays the step: what decodeV4Swap() says,
-                    // and the ETH of each SETTLE from the router of a known
-                    // amount when the router holds no other ETH.
-                    const paidByUser = v4
-                        ? v4.paidByUser.concat(
-                              routerHeldEth
-                                  ? []
-                                  : ethFromRouter.filter((s) =>
-                                        present(s.amount),
-                                    ),
-                          )
-                        : [];
                     if (v4) {
                         // Each SETTLE paid from the router spends the amount
                         // decodeV4Swap() says it pays.
@@ -1899,10 +1845,10 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
                         commandNames[i] += " (could not be decoded)";
                     }
                     // The step's amount, if it sets the input side: what the
-                    // user pays it of its input currency, or, when the user
-                    // pays none of it, what its swap actions spend of it,
-                    // whoever pays that.
-                    const paidIn = paidByUser.find(
+                    // user pays it of its input currency (see
+                    // decodeV4Swap()), or, when the user pays none of it,
+                    // what its swap actions spend of it, whoever pays that.
+                    const paidIn = v4?.paidByUser.find(
                         (p) => p.currency === v4.tokenIn,
                     );
                     const amountIn = paidIn ? paidIn.amount : v4?.amountIn;
@@ -1956,24 +1902,10 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
                     // router still runs it.
                     const setInputHere = inputEstablished && !inputSetBefore;
                     if (setInputHere) inputPaidByUser = paidIn !== undefined;
-                    for (const p of paidByUser) {
-                        if (setInputHere && p === paidIn) continue;
-                        addUserPaid(p.currency, p.amount);
-                    }
-                    // A SETTLE of ETH from the router that `paidByUser` leaves
-                    // out is a take of its own, even on the step that sets
-                    // the input side. Either this decoder does not know its
-                    // amount, or ETH an earlier step left in the router may
-                    // pay part of that amount (see userPaid).
-                    for (const p of ethFromRouter) {
-                        if (!present(p.amount)) {
-                            addUserPaid(p.currency, null);
-                        } else if (routerHeldEth) {
-                            userPaid.push({
-                                token: p.currency,
-                                amount: p.amount,
-                                atMost: true,
-                            });
+                    if (v4) {
+                        for (const p of v4.paidByUser) {
+                            if (setInputHere && p === paidIn) continue;
+                            addUserPaid(p.currency, p.amount);
                         }
                     }
                     if (!v4 || v4.settleUnread) {
@@ -2081,33 +2013,33 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
         // The total is what the steps take of Token In: the amount of the
         // step that set the input side, with each later take of that token
         // added to it while both are quantities. A take that cannot be added,
-        // being of another token, coming after an amount that is not a
-        // quantity (a V4 open delta, ALREADY_PAID, or none stated), or having
-        // `atMost` set, gets lines of its own. One whose amount is not known
-        // also leaves the total unknown, with no figure.
+        // being of another token or coming after an amount that is not a
+        // quantity (a V4 open delta, ALREADY_PAID, or none stated), gets
+        // lines of its own. One whose amount is not known also leaves the
+        // total unknown, with no figure.
         //
         // A PERMIT2_PERMIT names Token In only when its amount stands as the
         // Amount figure in place of the total, which it does only in the
         // plain shape of Uniswap's own routes: it comes before the step that
         // set the input side, it is the only PERMIT2_PERMIT in the
         // transaction and there is no PERMIT2_PERMIT_BATCH, its spender is
-        // the router, the router may not let it fail, no step before it took
-        // its token or one not known (a PERMIT2_TRANSFER_FROM of its token
-        // included), and this decoder read every step after it in full (see
-        // stepsUnread). Permit2 then lets the router take no more of the token
-        // than that amount, so the permit covers every take of it. A step
-        // before it takes under whatever allowance the router already had, so
-        // it may take more. A later permit or batch, or a later step this
-        // decoder did not read, may raise what Permit2 lets the router take.
+        // the router, its token is not the zero address, the router may not
+        // let it fail, no step before it took its token or one not known (a
+        // PERMIT2_TRANSFER_FROM of its token included), and this decoder read
+        // every step after it in full (see stepsUnread). Permit2 then lets the
+        // router take no more of the token than that amount, so the permit
+        // covers every take of it. Permit2 has no allowance of ETH, so a
+        // permit on the zero address covers no take of ETH. A step before it
+        // takes under whatever allowance the router already had, so it may
+        // take more. A later permit or batch, or a later step this decoder
+        // did not read, may raise what Permit2 lets the router take.
         // Every other PERMIT2_PERMIT leaves Token In and the Amount line as
-        // they read with no permit, and gets lines of its own below. A permit
-        // on the zero address never stands as the Amount figure, because
-        // Permit2 has no allowance of ETH. A step that may take from the
-        // sender what this decoder did not read leaves no figure, permit or
-        // not (see spentUnread()), and so do a permit or batch whose input it
-        // cannot read (see permitUnread()) and an allowance of Token In to
-        // another spender (see toAnotherSpender). An EXECUTE_SUB_PLAN step
-        // leaves both sides unknown (below).
+        // they read with no permit, and gets lines of its own below. A step
+        // that may take from the sender what this decoder did not read leaves
+        // no figure, permit or not (see spentUnread()), and so do a permit
+        // or batch whose input it cannot read (see permitUnread()) and an
+        // allowance of Token In to another spender (see toAnotherSpender). An
+        // EXECUTE_SUB_PLAN step leaves both sides unknown (below).
         const stepCommands = Array.from(
             commandsBytes,
             (b) => commands[b & commandTypeMask],
@@ -2128,14 +2060,14 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
         let total = null;
         // The takes from the sender that `total` adds up, each a quantity, as
         // { token, amount }. When there is no Amount line, each gets lines of
-        // its own (see below). The amount of the step that set the input side
-        // counts in `total` whoever pays that step. That amount is among them
-        // only when the user pays the step (see inputPaidByUser).
+        // its own (see below). The amount of a step that set the input side
+        // and is paid from the router counts in `total` but is not among them.
         const inTotal = [];
         // Whether the step that set the input side counts as a take from the
         // sender, which may get lines of its own. The amount it stated counts
         // whoever pays it. Stating none, it counts only when the user pays it
-        // some of its input token.
+        // some of its input token: paid from the router, it takes nothing
+        // from the sender.
         const hasFirstTake =
             inputEstablished && (present(inputAmount) || inputPaidByUser);
         // The take of the step that set the input side, when the total
@@ -2161,8 +2093,7 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
             if (
                 ofTokenIn &&
                 typeof total === "bigint" &&
-                typeof t.amount === "bigint" &&
-                !t.atMost
+                typeof t.amount === "bigint"
             ) {
                 total += t.amount;
                 inTotal.push(t);
@@ -2211,11 +2142,11 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
         // Any other output keeps its own token and figure: a swap that pays
         // its WETH to the user and then unwraps receives WETH, and one that
         // buys USDC and then unwraps the WETH it did not spend receives USDC.
-        const inInfo = tokenInfo(inputToken, tokenSources);
+        const inInfo = tokenInfo(inputToken, sources);
         const outInfo =
             outputUnwrapped || (hasUnwrapWeth && !outputEstablished)
                 ? { symbol: "ETH", decimals: 18, address: null }
-                : tokenInfo(outputToken, tokenSources);
+                : tokenInfo(outputToken, sources);
 
         const inSymbol = inInfo.symbol;
         const outSymbol = outInfo.symbol;
@@ -2265,9 +2196,8 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
         // V2's already-paid zero, neither of which is a quantity at all (see
         // OPEN_DELTA and ALREADY_PAID), and an unbounded permit. Those two
         // tests come first — the sentinels are not bigints and cannot be
-        // compared with one. `atMost` marks an amount that is only the most a
-        // take may be (see userPaid).
-        const spentText = (amount, info, atMost) => {
+        // compared with one.
+        const spentText = (amount, info) => {
             if (amount === OPEN_DELTA) {
                 return { raw: OPEN_DELTA_AMOUNT, display: OPEN_DELTA_AMOUNT };
             }
@@ -2280,7 +2210,7 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
             if (amount >= MAX_UINT160) {
                 return { raw: "Unlimited", display: "Unlimited" };
             }
-            if (hasV2OrV3ExactOut || atMost) {
+            if (hasV2OrV3ExactOut) {
                 // A V2 or V3 exact-out swap spends at most this figure,
                 // whichever steps gave it (an amountInMax, the WRAP_ETH of a
                 // swap paid in ETH, a permit, or several steps' total), so it
@@ -2307,19 +2237,17 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
         // A null token in `spentFromSender`, a step this decoder did not read
         // or a token it does not know, and an allowance to another spender
         // that may be of Token In, leave no Amount figure, which may then be
-        // too low. An allowance of the zero address is never one of Token In,
-        // because Permit2 has no allowance of ETH. With no Amount line, each
-        // take the total adds up gets lines of its own, first, so that every
-        // amount this decoder read is shown.
+        // too low. With no Amount line, each take the total adds up gets
+        // lines of its own, first, so that every amount this decoder read is
+        // shown.
         if (
             present(inputAmount) &&
             spentFromSender.every((s) => present(s.token)) &&
             toAnotherSpender.every(
                 (p) =>
-                    p.token === "0x0000000000000000000000000000000000000000" ||
-                    (present(p.token) &&
-                        present(inputToken) &&
-                        !sameAddress(p.token, inputToken)),
+                    present(p.token) &&
+                    present(inputToken) &&
+                    !sameAddress(p.token, inputToken),
             )
         ) {
             const amount = spentText(inputAmount, inInfo);
@@ -2340,20 +2268,11 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
             details.push({
                 label: "Moved from the sender",
                 value: present(s.amount)
-                    ? spentText(
-                          s.amount,
-                          tokenInfo(s.token, tokenSources),
-                          s.atMost,
-                      ).display
+                    ? spentText(s.amount, tokenInfo(s.token, sources)).display
                     : UNDECODED_CURRENCY,
             });
             if (present(s.token)) {
-                details.push(
-                    tokenMovedLine(
-                        "Token moved",
-                        tokenInfo(s.token, tokenSources),
-                    ),
-                );
+                details.push(tokenMovedLine("Token moved", s.token, sources));
                 details.push({
                     label: "Moved to",
                     value: "The swap step that spends it",
@@ -2364,12 +2283,12 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
         // What each PERMIT2_TRANSFER_FROM moves: its amount, its token and
         // where it goes, an address on a line of its own.
         for (const m of movedFromSender) {
-            const info = permit2TokenInfo(m.token, tokenSources);
             details.push({
                 label: "Moved from the sender",
-                value: amountText(m.amount, info).display,
+                value: amountText(m.amount, tokenInfo(m.token, sources))
+                    .display,
             });
-            details.push(tokenMovedLine("Token moved", info));
+            details.push(tokenMovedLine("Token moved", m.token, sources));
             details.push(
                 present(m.to)
                     ? { label: "Moved to", value: m.to }
@@ -2399,15 +2318,36 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
                 });
                 continue;
             }
-            const info = permit2TokenInfo(p.token, tokenSources);
-            details.push({
-                label: "Permit2 allowance",
-                value:
-                    p.amount >= MAX_UINT160
-                        ? "Unlimited"
-                        : amountText(p.amount, info).display,
-            });
-            details.push(tokenMovedLine("Allowance token", info));
+            // Permit2 has no allowance of ETH. An allowance of the zero
+            // address reads as one of a token nothing knows: its amount in
+            // base units, and the zero address as its token.
+            if (p.token === "0x0000000000000000000000000000000000000000") {
+                details.push({
+                    label: "Permit2 allowance",
+                    value:
+                        p.amount >= MAX_UINT160
+                            ? "Unlimited"
+                            : unknownDecimalsAmount(p.amount),
+                });
+                details.push({
+                    label: "Allowance token",
+                    value: p.token,
+                    address: p.token,
+                    isToken: true,
+                });
+            } else {
+                details.push({
+                    label: "Permit2 allowance",
+                    value:
+                        p.amount >= MAX_UINT160
+                            ? "Unlimited"
+                            : amountText(p.amount, tokenInfo(p.token, sources))
+                                  .display,
+                });
+                details.push(
+                    tokenMovedLine("Allowance token", p.token, sources),
+                );
+            }
             details.push({
                 label: "Allowance spender",
                 value: p.spender,
@@ -2465,7 +2405,7 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
             paidTo.push({ label: "Paid to", value: PAID_TO_BRIDGE });
         }
         for (const m of movedIntoRouter) {
-            const info = permit2TokenInfo(m.token, tokenSources);
+            const info = tokenInfo(m.token, sources);
             paidTo.push({
                 label: "Paid to",
                 value:
@@ -2473,7 +2413,9 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
                     amountText(m.amount, info).display +
                     " from the sender (later steps may not spend all of it)",
             });
-            paidTo.push(tokenMovedLine("Token moved into the router", info));
+            paidTo.push(
+                tokenMovedLine("Token moved into the router", m.token, sources),
+            );
         }
         if (outputHeld) {
             paidTo.push({ label: "Paid to", value: STAYS_IN_ROUTER });
@@ -2490,7 +2432,8 @@ function decode(data, toAddress, chainId, sources, fromAddress) {
             paidTo.push(
                 tokenMovedLine(
                     "Token moved into the router",
-                    tokenInfo(getAddress(token), tokenSources),
+                    getAddress(token),
+                    sources,
                 ),
             );
         }

tests/addressValue.test.js

@@ -1,9 +1,9 @@
 // The USD total of an address that holds something this build cannot price
 // (issue #261).
 //
-// Only a token with a price feed has a price, so an address can hold real
-// assets with no price attached. Summing what is priced and printing the result
-// as the total says "$0.00" for an address holding nothing but unpriced tokens —
+// Prices exist for the top 25 tokens only, so an address can hold real assets
+// with no price attached. Summing what is priced and printing the result as
+// the total says "$0.00" for an address holding nothing but unpriced tokens —
 // worth-nothing and worth-an-unknown-amount collapsed into one number, in the
 // direction that matters. The two are separate facts here, the same way an
 // absent holders_count is not a count of zero.
@@ -63,7 +63,7 @@ const PARTLY_PRICED = {
 beforeEach(() => {
     clearPrices();
     prices.ETH = 2000;
-    prices[USDC] = 1;
+    prices.USDC = 1;
     state.wallets = [];
     state.trackedTokens = [];
     state.showZeroBalanceTokens = false;

tests/approvalAmount.test.js

@@ -90,11 +90,9 @@ beforeEach(() => {
 });
 
 describe("resolveTokenDecimals", () => {
-    // The bundled list is read only for a token on Ethereum Mainnet.
     test("prefers the bundled list", () => {
         state.trackedTokens = [{ address: USDC, symbol: "USDC", decimals: 2 }];
-        const sources = { chainId: "0x1", trackedTokens: state.trackedTokens };
-        expect(resolveTokenDecimals(USDC, sources)).toBe(6);
+        expect(resolveTokenDecimals(USDC, state)).toBe(6);
     });
 
     test("reads a token the user tracks", () => {
@@ -126,8 +124,7 @@ describe("resolveTokenDecimals", () => {
     // answers 0 is used rather than fallen past like the unusable entry above.
     test("uses a bundled scale of zero", () => {
         state.trackedTokens = [{ address: SLP, symbol: "SLP", decimals: 18 }];
-        const sources = { chainId: "0x1", trackedTokens: state.trackedTokens };
-        expect(resolveTokenDecimals(SLP, sources)).toBe(0);
+        expect(resolveTokenDecimals(SLP, state)).toBe(0);
     });
 
     test("uses a tracked scale of zero", () => {

tests/approvalBundledListSepolia.test.js

@@ -1,169 +0,0 @@
-// The approval screen for a site's Sepolia transfer of the contract at USDC's
-// mainnet address, while Sepolia is active.
-//
-// The bundled token list holds Ethereum Mainnet contracts. The contract at the
-// same address on Sepolia is another token, but the screen named it USDC and
-// scaled its amount at USDC's decimals
-// (https://git.eeqj.de/sneak/AutistMask/issues/632). The bundled list now names
-// a token only on Ethereum Mainnet. The same screen for a mainnet transfer of
-// USDC, while Sepolia is active, still names USDC.
-//
-// Driven through the real approval screen, against the minimal DOM stub
-// tests/approvalTokenNetwork.test.js uses.
-
-globalThis.chrome = {
-    storage: { local: { get: async () => ({}), set: async () => {} } },
-};
-
-const { Interface } = require("ethers");
-const { state } = require("../src/shared/state");
-const { NETWORKS } = require("../src/shared/networks");
-const approval = require("../src/popup/views/approval");
-
-const FROM = "0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266";
-const RECIPIENT = "0x711e691962E5c054b78071C789A0C8CE657377aD";
-// USDC's address on Ethereum Mainnet, where the bundled list names it.
-const USDC = "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48";
-
-// FROM sends 1234500000 base units to RECIPIENT.
-const TRANSFER_DATA = new Interface([
-    "function transfer(address to, uint256 amount)",
-]).encodeFunctionData("transfer", [RECIPIENT, 1234500000n]);
-
-function makeElement(id) {
-    const classes = new Set();
-    const el = {
-        id,
-        textContent: "",
-        value: "",
-        innerHTML: "",
-        disabled: false,
-        style: {},
-        dataset: {},
-        listeners: {},
-        classList: {
-            add: (...names) => names.forEach((n) => classes.add(n)),
-            remove: (...names) => names.forEach((n) => classes.delete(n)),
-            contains: (n) => classes.has(n),
-            toggle: (n, force) => {
-                const on = force === undefined ? !classes.has(n) : force;
-                if (on) classes.add(n);
-                else classes.delete(n);
-                return on;
-            },
-        },
-        addEventListener: (name, fn) => {
-            el.listeners[name] = el.listeners[name] || [];
-            el.listeners[name].push(fn);
-        },
-        querySelectorAll: () => [],
-        appendChild: () => {},
-    };
-    // Views reach for .parentElement to hide whole sections.
-    Object.defineProperty(el, "parentElement", {
-        get: () => node(id + "-parent"),
-    });
-    return el;
-}
-
-function makeDocument() {
-    const els = new Map();
-    return {
-        getElementById(id) {
-            // The debug banner is created on demand by helpers.js; absent
-            // is the state a non-debug, non-testnet popup is in.
-            if (id === "debug-banner") return null;
-            if (!els.has(id)) els.set(id, makeElement(id));
-            return els.get(id);
-        },
-        createElement: () => makeElement("created"),
-        body: { prepend: () => {} },
-    };
-}
-
-function node(id) {
-    return globalThis.document.getElementById(id);
-}
-
-// One line of the decoded details: its label and what is drawn under it.
-function decodedLine(label) {
-    return node("approve-tx-decoded-details")
-        .innerHTML.split('<div class="mb-2">')
-        .find((line) =>
-            line.startsWith(`<div class="text-muted">${label}</div>`),
-        );
-}
-
-// Open the approval screen, with Sepolia active, for the site's transaction
-// sending TRANSFER_DATA to the contract at USDC's address on the network with
-// chain id `chainId`.
-async function showTransfer(chainId) {
-    globalThis.document = makeDocument();
-    globalThis.window = { location: { search: "" }, close: () => {} };
-    globalThis.chrome.runtime = {
-        connect: () => ({ postMessage: () => {} }),
-        sendMessage: (msg, reply) => {
-            if (!reply) return;
-            reply({
-                type: "tx",
-                origin: "https://dapp.example",
-                isPhishingDomain: false,
-                approvedFrom: FROM,
-                approvedTx: {
-                    type: 2,
-                    from: FROM,
-                    chainId,
-                    nonce: "0x7",
-                    gasLimit: "0x30d40",
-                    maxPriorityFeePerGas: "0x3b9aca00",
-                    maxFeePerGas: "0x77359400",
-                    to: USDC,
-                    value: "0x0",
-                    data: TRANSFER_DATA,
-                    accessList: [],
-                },
-            });
-        },
-    };
-    state.networkId = "sepolia";
-    state.trackedTokens = [];
-    state.networkTrackedTokens = {};
-    state.activeAddress = FROM;
-    state.wallets = [
-        {
-            type: "hd",
-            name: "Wallet 1",
-            xpub: "xpub-wallet-1",
-            encryptedSecret: "encrypted-secret-1",
-            nextIndex: 1,
-            addresses: [
-                { address: FROM, index: 0, balance: "0", tokenBalances: [] },
-            ],
-        },
-    ];
-    state.currentView = null;
-    approval.init({});
-    await approval.show(1);
-}
-
-test("names no token, and states the amount in base units", async () => {
-    await showTransfer(NETWORKS.sepolia.chainId);
-    expect(state.currentView).toBe("approve-tx");
-    expect(node("approve-tx-to").innerHTML).not.toContain("USDC");
-    expect(decodedLine("Token")).toContain(
-        '<div class="font-bold">Unknown token</div>',
-    );
-    expect(decodedLine("Amount")).toContain(
-        '<div class="font-bold">1234500000 base units (decimals unknown)</div>',
-    );
-});
-
-// A transaction is named for its own network, not the active one.
-test("a mainnet transfer of USDC is still named and scaled as USDC", async () => {
-    await showTransfer(NETWORKS.mainnet.chainId);
-    expect(state.currentView).toBe("approve-tx");
-    expect(decodedLine("Token")).toContain('<div class="font-bold">USDC</div>');
-    expect(decodedLine("Amount")).toContain(
-        '<div class="font-bold">1234.5000 USDC</div>',
-    );
-});

tests/balanceRefreshNetworkSwitch.test.js

@@ -6,10 +6,6 @@
 // approved a site's request, which changes only the stored record. Driven
 // through the real popup over a stored profile on Ethereum Mainnet. The same
 // refresh in the background is in tests/backgroundStateIsolation.test.js.
-//
-// The last test covers a balance refresh by the background that is saved while
-// a switch in Settings waits for the lock
-// (https://git.eeqj.de/sneak/AutistMask/issues/653).
 
 const {
     bootPopup,
@@ -163,50 +159,3 @@ test("a refresh that returns after the background switched the network writes no
 
     expectNothingStored(page);
 });
-
-// The background's refresh saves Ethereum Mainnet's balances while the switch
-// in Settings waits for the lock. This page last saved a balance of "0" and no
-// token balances, the values that the switch sets.
-test("a background refresh saved while a switch in Settings waits for the lock leaves none of its balances stored", async () => {
-    const profile = unversionedValidProfile();
-    profile.wallets[0].addresses[0].balance = "0";
-    const page = await bootPopup(profile);
-    expect(page.pageErrors).toEqual([]);
-    const background = require("../src/background/state");
-    await page.click("btn-settings");
-
-    // The background takes the lock first and holds it until the test calls
-    // `letGo()`. It then saves balances as backgroundRefresh() in
-    // src/background/index.js does.
-    let letGo;
-    const refreshSave = background.updateState(async (fresh) => {
-        await new Promise((resolve) => {
-            letGo = resolve;
-        });
-        fresh.wallets[0].addresses[0].balance = "7.0";
-        fresh.wallets[0].addresses[0].tokenBalances = [
-            {
-                address: TOKEN_ADDRESS,
-                name: "Test Token",
-                symbol: "TST",
-                decimals: 18,
-                balance: "5.0",
-                holders: null,
-            },
-        ];
-        fresh.lastBalanceRefresh = Date.now();
-    });
-    await page.settle();
-
-    const select = page.node("settings-network");
-    select.value = "sepolia";
-    const switching = Promise.all(select.listeners.change.map((fn) => fn()));
-    await page.settle();
-
-    letGo();
-    await refreshSave;
-    await switching;
-    await page.settle();
-
-    expectNothingStored(page);
-});

tests/bundledListScreens.test.js

@@ -1,81 +0,0 @@
-// The token screen, the Send screen and the confirmation screen for the
-// contract at USDC's mainnet address. No address holds it and the user does
-// not track it, so only the bundled token list can name it.
-//
-// The bundled token list holds Ethereum Mainnet contracts, so these screens
-// name the token from it on Ethereum Mainnet only
-// (https://git.eeqj.de/sneak/AutistMask/issues/632). Driven through the real
-// popup over a stored profile.
-
-const {
-    bootPopup,
-    cleanupPopup,
-    unversionedValidProfile,
-} = require("./support/popupBoot");
-
-const USDC = "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48";
-const RECIPIENT = "0x711e691962E5c054b78071C789A0C8CE657377aD";
-
-afterEach(() => {
-    cleanupPopup();
-});
-
-// The popup reopened onto AddressToken for USDC's address, on `networkId`.
-function bootOnToken(networkId) {
-    return bootPopup(
-        unversionedValidProfile({
-            networkId,
-            currentView: "address-token",
-            viewStack: ["main", "address"],
-            selectedWallet: 0,
-            selectedAddress: 0,
-            selectedToken: USDC,
-        }),
-    );
-}
-
-// AddressToken's Send, then Review for 1 token to RECIPIENT.
-async function reviewSend(boot) {
-    await boot.click("btn-address-token-send");
-    expect(boot.visibleViews()).toEqual(["send"]);
-    boot.node("send-to").value = RECIPIENT;
-    boot.node("send-amount").value = "1";
-    await boot.click("btn-send-review");
-    expect(boot.visibleViews()).toEqual(["confirm-tx"]);
-}
-
-describe("on Ethereum Mainnet, the bundled list names the token", () => {
-    test("on the token screen", async () => {
-        const boot = await bootOnToken("mainnet");
-        expect(boot.visibleViews()).toEqual(["address-token"]);
-        expect(boot.text("address-token-title")).toContain("USDC");
-        const info = boot.node("address-token-contract-info").innerHTML;
-        expect(info).toContain(
-            '<span class="text-muted">Decimals:</span> 6</div>',
-        );
-    });
-
-    test("on the Send screen and the confirmation screen", async () => {
-        const boot = await bootOnToken("mainnet");
-        await reviewSend(boot);
-        expect(boot.text("send-balance")).toContain("USDC");
-        expect(boot.text("confirm-amount")).toContain("USDC");
-    });
-});
-
-describe("with Sepolia active, the bundled list does not name the token", () => {
-    test("on the token screen", async () => {
-        const boot = await bootOnToken("sepolia");
-        expect(boot.visibleViews()).toEqual(["address-token"]);
-        expect(boot.text("address-token-title")).not.toContain("USDC");
-        const info = boot.node("address-token-contract-info").innerHTML;
-        expect(info).not.toContain("Decimals:");
-    });
-
-    test("on the Send screen and the confirmation screen", async () => {
-        const boot = await bootOnToken("sepolia");
-        await reviewSend(boot);
-        expect(boot.text("send-balance")).not.toContain("USDC");
-        expect(boot.text("confirm-amount")).not.toContain("USDC");
-    });
-});

tests/confirmTxNetworkSwitch.test.js

@@ -226,7 +226,6 @@ const PRIVATE_KEY = "0x" + "11".repeat(32);
 const HOLDER = new Wallet(PRIVATE_KEY).address;
 const RECIPIENT = "0xC0FfEE0000000000000000000000000000c0fFEe";
 const TOKEN = "0x7070707070707070707070707070707070707070";
-const USDC = "0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48";
 const PASSWORD = "correct horse battery staple";
 
 function el(id) {
@@ -319,7 +318,7 @@ async function switchReopenAndGoBack(reviewedOn, switchedTo) {
     setBackRenderer(makeBackRenderer(state, { confirmTx }));
     confirmTx.init({});
     prices.ETH = 2000;
-    prices[USDC] = 1;
+    prices.USDC = 1;
     mockNode.asked = [];
     global.fetch.mockClear();
     goBack();
@@ -642,7 +641,7 @@ describe.each([
         test("of an ERC-20 token, links the token contract to that network's explorer and prices the token by that network", async () => {
             mockNode.tokenUnits[reviewedOn] = 50000000n;
             await review(reviewedOn, {
-                token: USDC,
+                token: TOKEN,
                 tokenSymbol: "USDC",
                 tokenDecimals: 6,
                 amount: "10",
@@ -653,7 +652,7 @@ describe.each([
                 "ERC-20 token transfer (USDC)",
             );
             expect(el("confirm-token-contract").innerHTML).toContain(
-                `href="${explorerUrl}/address/${USDC}"`,
+                `href="${explorerUrl}/address/${TOKEN}"`,
             );
             expect(el("confirm-amount").textContent).toBe(
                 "10.0000 USDC" + usdOn(reviewedOn, "$10.00"),

tests/deleteAddress.test.js

@@ -153,7 +153,7 @@ describe("the balance warning on the removal confirmation", () => {
 
     test("the USD total is shown when prices are known", () => {
         prices.ETH = 2000;
-        prices[USDC] = 1;
+        prices.USDC = 1;
         expect(balanceWarningHtml(TOKEN_ONLY)).toContain("Total: $2,500.00");
         expect(balanceWarningHtml(ETH_ONLY)).toContain("Total: $3,000.00");
     });

tests/e2e/dapp.js

@@ -43,15 +43,12 @@ const GAS_PRICE_WEI = BASE_FEE_WEI + PRIORITY_FEE_WEI;
 
 const STUB_BLOCK_NUMBER = 21000000;
 
-// A 32-byte zero word, returned for every eth_call but a price feed's
-// latestRoundData() (see rpcResult() below). It is what makes ethers'
+// A 32-byte zero word, returned for every eth_call. It is what makes ethers'
 // ENS reverse lookup resolve to "no resolver set" instead of throwing, and a
 // throw there reaches the console through src/shared/log.js, which fails the
 // run on its own.
 const ZERO_WORD = "0x" + "0".repeat(64);
 
-const SELECTOR_LATEST_ROUND_DATA = "0xfeaf968c";
-
 // One ETH, so the popup's balance lines render something and the wallet does
 // not look empty on the approval screen.
 const STUB_BALANCE_WEI = 10n ** 18n;
@@ -114,15 +111,6 @@ function rpcResult(req, state) {
         return latestBlock();
     }
 
-    // A price feed's latestRoundData() gets five zero words, as in network.js:
-    // a price of zero, which the wallet counts as no price.
-    const data = String(
-        (req.params && req.params[0] && req.params[0].data) || "",
-    );
-    if (method === "eth_call" && data.startsWith(SELECTOR_LATEST_ROUND_DATA)) {
-        return "0x" + "0".repeat(64 * 5);
-    }
-
     if (Object.prototype.hasOwnProperty.call(RPC_RESULTS, method)) {
         return RPC_RESULTS[method];
     }

tests/e2e/network.js

@@ -251,13 +251,8 @@ const SELECTOR_DECIMALS = "0x313ce567";
 const SELECTOR_SYMBOL = "0x95d89b41";
 const SELECTOR_NAME = "0x06fdde03";
 const SELECTOR_BALANCE_OF = "0x70a08231";
-const SELECTOR_LATEST_ROUND_DATA = "0xfeaf968c";
 
-// On any contract, a latestRoundData() call is answered with five zero words.
-// That is a round with a price of zero, which the wallet counts as no
-// price. So no screen shows a USD value beside the amounts the tests compare.
-//
-// Every other eth_call answers with a zero word except decimals(), symbol(),
+// Every eth_call still answers with a zero word except decimals(), symbol(),
 // name() and balanceOf() on the stub token. The wallet reads decimals() back
 // at signing time to compare with the scale the confirmation screen rendered
 // (issue #305). Adding the token by its contract address reads the first three
@@ -278,9 +273,6 @@ function ethCallResult(req, opts) {
     if (!call || typeof call !== "object") return ZERO_WORD;
     const data = String(call.data || call.input || "").toLowerCase();
     const to = String(call.to || "").toLowerCase();
-    if (data.startsWith(SELECTOR_LATEST_ROUND_DATA)) {
-        return "0x" + "0".repeat(64 * 5);
-    }
     if (to !== STUB_TOKEN.address) return ZERO_WORD;
     if (data.startsWith(SELECTOR_DECIMALS)) {
         return word(opts.tokenDecimalsOverride ?? STUB_TOKEN.decimals);
@@ -772,6 +764,11 @@ async function installNetworkStubs(ctx, opts) {
             }
         }
 
+        // CoinDesk price tick
+        if (url.hostname.endsWith("coindesk.com")) {
+            return jsonResponse(route, { Data: {} });
+        }
+
         // The interception canary's own request. Answered with nothing: what
         // is being observed is that it arrived here at all.
         if (url.href === WORKER_PROBE_URL) {

tests/fabricatedDecimals.test.js

@@ -111,15 +111,13 @@ function respondWith(items) {
 }
 
 // Fetch and place the result exactly where refreshBalances() places it, so the
-// approval screens read what a real refresh on Ethereum Mainnet would have
-// left on state.
+// approval screens read what a real refresh would have left on state.
 async function fetchOnto(items, trackedTokens = []) {
     respondWith(items);
     const balances = await fetchTokenBalances(
         HOLDER,
         BLOCKSCOUT,
         trackedTokens,
-        "0x1",
     );
     state.trackedTokens = trackedTokens;
     state.wallets = [

tests/holders.test.js

@@ -192,13 +192,7 @@ describe("the balance-list spam gate", () => {
                 },
             }),
         ]);
-        // On Ethereum Mainnet, the only network the known-token list covers.
-        const balances = await fetchTokenBalances(
-            HOLDER,
-            BLOCKSCOUT,
-            [],
-            "0x1",
-        );
+        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, []);
         expect(balances).toHaveLength(1);
         expect(balances[0].holders).toBeNull();
     });

tests/popupFollowsNetworkSwitch.test.js

@@ -253,271 +253,6 @@ test("a switch back in Settings after a follow whose write failed is stored", as
     expect(told.at(-1).chainId).toBe(NETWORKS.mainnet.chainId);
 });
 
-// The user saves an endpoint URL in Settings on Ethereum Mainnet. Before the
-// URL is stored, the background saves a switch to Sepolia. Another write holds
-// the lock, so the popup's follow of that switch and the URL's save both wait
-// for the lock. Either may take it first. The URL is stored for neither
-// network. The flash message says that the network changed.
-test.each([
-    { button: "btn-save-rpc", field: "settings-rpc", first: "follow" },
-    { button: "btn-save-rpc", field: "settings-rpc", first: "save" },
-    {
-        button: "btn-save-blockscout",
-        field: "settings-blockscout",
-        first: "follow",
-    },
-    {
-        button: "btn-save-blockscout",
-        field: "settings-blockscout",
-        first: "save",
-    },
-])(
-    "$button saves nothing when the network changes before the URL is stored ($first first)",
-    async ({ button, field, first }) => {
-        const page = await bootOnAddress();
-        await page.click("btn-settings");
-        // This answer passes both endpoint checks. The RPC check reads
-        // Ethereum Mainnet's chain id from it. The Blockscout check reads `ok`.
-        globalThis.fetch.mockResolvedValue({
-            ok: true,
-            json: async () => ({ result: NETWORKS.mainnet.chainId }),
-        });
-        const url = "https://own-node.example.invalid";
-
-        let releaseLock;
-        const lockHeld = navigator.locks.request(
-            "autistmask",
-            () =>
-                new Promise((resolve) => {
-                    releaseLock = resolve;
-                }),
-        );
-        // The click handler runs until its save waits for the lock.
-        const tapSave = async () => {
-            page.node(field).value = url;
-            const saving = page.node(button).listeners.click.map((fn) => fn());
-            await page.settle();
-            return saving;
-        };
-        let saving;
-        if (first === "save") saving = await tapSave();
-        await backgroundSwitch(page, "sepolia");
-        if (first === "follow") saving = await tapSave();
-        releaseLock();
-        await lockHeld;
-        await Promise.all(saving);
-        await page.settle();
-
-        const { state } = require("../src/shared/state");
-        expect(state.networkId).toBe("sepolia");
-        expect(JSON.stringify(page.storage.read("autistmask"))).not.toContain(
-            url,
-        );
-        expect(page.text("flash-msg")).toBe(
-            "The URL was not saved because the network changed.",
-        );
-    },
-);
-
-// The popup's follow of the background's switch to Sepolia has set `state` to
-// Sepolia. The follow's write has not returned yet, so Settings still shows
-// Ethereum Mainnet. The user taps "Save" there. The URL is for Ethereum
-// Mainnet, so the save stores the URL for neither network.
-test.each([
-    { button: "btn-save-rpc", field: "settings-rpc" },
-    { button: "btn-save-blockscout", field: "settings-blockscout" },
-])(
-    "$button saves nothing when tapped while the follow's write waits",
-    async ({ button, field }) => {
-        const page = await bootOnAddress();
-        await page.click("btn-settings");
-        // This answer passes both endpoint checks on Ethereum Mainnet.
-        globalThis.fetch.mockResolvedValue({
-            ok: true,
-            json: async () => ({ result: NETWORKS.mainnet.chainId }),
-        });
-        const url = "https://own-node.example.invalid";
-
-        const { set } = page.storage.local;
-        const write = set.getMockImplementation();
-        let releaseWrite;
-        const writeHeld = new Promise((resolve) => {
-            releaseWrite = resolve;
-        });
-        // The background's write lands; the next, the follow's, waits.
-        set.mockImplementationOnce(write).mockImplementationOnce(
-            async (items) => {
-                await writeHeld;
-                await write(items);
-            },
-        );
-        await backgroundSwitch(page, "sepolia");
-        const { state } = require("../src/shared/state");
-        expect(state.networkId).toBe("sepolia");
-        expect(page.value("settings-network")).toBe("mainnet");
-
-        page.node(field).value = url;
-        const saving = page.node(button).listeners.click.map((fn) => fn());
-        await page.settle();
-        releaseWrite();
-        await Promise.all(saving);
-        await page.settle();
-
-        expect(JSON.stringify(page.storage.read("autistmask"))).not.toContain(
-            url,
-        );
-        expect(page.text("flash-msg")).toBe(
-            "The URL was not saved because the network changed.",
-        );
-    },
-);
-
-// The user taps the RPC "Save" on Ethereum Mainnet. While the check waits for
-// the node's answer, the popup follows the background's switch to Sepolia. The
-// node answers with Sepolia's chain id. So the check refuses the node for
-// Ethereum Mainnet, and nothing is stored.
-test("the RPC check compares the answer with the network at the tap", async () => {
-    const page = await bootOnAddress();
-    await page.click("btn-settings");
-    let answer;
-    globalThis.fetch.mockReturnValue(
-        new Promise((resolve) => {
-            answer = resolve;
-        }),
-    );
-    const url = "https://sepolia-node.example.invalid";
-
-    page.node("settings-rpc").value = url;
-    const saving = page.node("btn-save-rpc").listeners.click.map((fn) => fn());
-    await page.settle();
-    await backgroundSwitch(page, "sepolia");
-    const { state } = require("../src/shared/state");
-    expect(state.networkId).toBe("sepolia");
-    answer({ json: async () => ({ result: NETWORKS.sepolia.chainId }) });
-    await Promise.all(saving);
-    await page.settle();
-
-    expect(JSON.stringify(page.storage.read("autistmask"))).not.toContain(url);
-    expect(page.text("flash-msg")).toBe(
-        "Wrong network: expected Ethereum Mainnet.",
-    );
-});
-
-// The user taps the Blockscout "Save" on Ethereum Mainnet. While the check
-// waits for Blockscout's answer, the popup follows the background's switch to
-// Sepolia. The URL is for Ethereum Mainnet, so nothing is stored.
-test("the Blockscout save is for the network at the tap", async () => {
-    const page = await bootOnAddress();
-    await page.click("btn-settings");
-    let answer;
-    globalThis.fetch.mockReturnValue(
-        new Promise((resolve) => {
-            answer = resolve;
-        }),
-    );
-    const url = "https://own-explorer.example.invalid/api/v2";
-
-    page.node("settings-blockscout").value = url;
-    const saving = page
-        .node("btn-save-blockscout")
-        .listeners.click.map((fn) => fn());
-    await page.settle();
-    await backgroundSwitch(page, "sepolia");
-    expect(page.value("settings-network")).toBe("sepolia");
-    answer({ ok: true });
-    await Promise.all(saving);
-    await page.settle();
-
-    expect(JSON.stringify(page.storage.read("autistmask"))).not.toContain(url);
-    expect(page.text("flash-msg")).toBe(
-        "The URL was not saved because the network changed.",
-    );
-});
-
-// Settings is open when the network changes to Sepolia. The popup follows the
-// background's switch, or the user picks Sepolia in the network selector. Each
-// "Save" after the switch stores its URL for Sepolia.
-test.each([
-    ["a follow", (page) => backgroundSwitch(page, "sepolia")],
-    [
-        "the network selector",
-        async (page) => {
-            const select = page.node("settings-network");
-            select.value = "sepolia";
-            for (const fn of select.listeners.change) await fn();
-            await page.settle();
-        },
-    ],
-])(
-    "after a switch to Sepolia by %s, Settings saves each URL for Sepolia",
-    async (_how, switchToSepolia) => {
-        const page = await bootOnAddress();
-        await page.click("btn-settings");
-        await switchToSepolia(page);
-        // This answer passes both endpoint checks on Sepolia. The RPC check
-        // reads Sepolia's chain id from it. The Blockscout check reads `ok`.
-        globalThis.fetch.mockResolvedValue({
-            ok: true,
-            json: async () => ({ result: NETWORKS.sepolia.chainId }),
-        });
-        const rpcUrl = "https://own-node.example.invalid";
-        const blockscoutUrl = "https://own-explorer.example.invalid/api/v2";
-
-        page.node("settings-rpc").value = rpcUrl;
-        await page.click("btn-save-rpc");
-        expect(page.text("flash-msg")).toBe("Saved.");
-        page.node("settings-blockscout").value = blockscoutUrl;
-        await page.click("btn-save-blockscout");
-        expect(page.text("flash-msg")).toBe("Saved.");
-
-        const stored = page.storage.read("autistmask");
-        expect(stored.networkId).toBe("sepolia");
-        expect(stored.rpcUrl).toBe(rpcUrl);
-        expect(stored.blockscoutUrl).toBe(blockscoutUrl);
-    },
-);
-
-// The user picks Sepolia in Settings, but the switch's write fails. The page is
-// then on Sepolia, while Settings was last drawn for Ethereum Mainnet. A "Save"
-// after the failed switch stores nothing for either network.
-test.each([
-    { button: "btn-save-rpc", field: "settings-rpc" },
-    { button: "btn-save-blockscout", field: "settings-blockscout" },
-])(
-    "$button saves nothing after a switch in Settings whose write failed",
-    async ({ button, field }) => {
-        const page = await bootOnAddress();
-        await page.click("btn-settings");
-        page.storage.local.set.mockRejectedValueOnce(
-            new Error("quota exceeded"),
-        );
-        const select = page.node("settings-network");
-        select.value = "sepolia";
-        for (const fn of select.listeners.change) {
-            await expect(fn()).rejects.toThrow("quota exceeded");
-        }
-        await page.settle();
-        const { state } = require("../src/shared/state");
-        expect(state.networkId).toBe("sepolia");
-        // This answer passes both endpoint checks on Ethereum Mainnet.
-        globalThis.fetch.mockResolvedValue({
-            ok: true,
-            json: async () => ({ result: NETWORKS.mainnet.chainId }),
-        });
-        const url = "https://own-node.example.invalid";
-
-        page.node(field).value = url;
-        await page.click(button);
-
-        expect(JSON.stringify(page.storage.read("autistmask"))).not.toContain(
-            url,
-        );
-        expect(page.text("flash-msg")).toBe(
-            "The URL was not saved because the network changed.",
-        );
-    },
-);
-
 // Such as one a newer build wrote, which this build cannot read. Nothing reads
 // or writes the stored record for it: the popup's next save finds it, as
 // before.

tests/priceFeeds.test.js

@@ -1,272 +0,0 @@
-// USD prices are read from Chainlink price feeds on mainnet, through the RPC
-// endpoint (https://git.eeqj.de/sneak/AutistMask/issues/525).
-//
-// The real refreshPrices() runs against a fake JSON-RPC node, answered through
-// ethers' own request hook. The hook also records the body of every HTTP
-// request, so a test can count them.
-
-// prices.js pulls in state.js, which reads chrome.storage.local at load.
-globalThis.chrome = {
-    storage: { local: { get: async () => ({}), set: async () => {} } },
-};
-
-const { AbiCoder, FetchRequest } = require("ethers");
-const {
-    prices,
-    refreshPrices,
-    clearPrices,
-    getPrice,
-    getAddressValue,
-} = require("../src/shared/prices");
-const { state } = require("../src/shared/state");
-const {
-    TOKENS,
-    ETH_USD_FEED,
-    USD_PRICE_FEEDS,
-    PRICE_FEED_BY_ADDRESS,
-} = require("../src/shared/tokenList");
-
-const RPC_URL = "https://rpc.example.invalid";
-const NOW = Date.UTC(2026, 9, 27, 12, 0, 0);
-const NOW_SECONDS = NOW / 1000;
-
-const USDC = "0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48";
-const LINK = "0x514910771af9ca656af840dff83e8264ecf986ca";
-const DAI = "0x6b175474e89094c44da98b954eedeac495271d0f";
-// A token at an address of its own that calls itself USDC.
-const FAKE_USDC = "0x9999999999999999999999999999999999999999";
-
-const ETH_FEED = ETH_USD_FEED.address.toLowerCase();
-const USDC_FEED = PRICE_FEED_BY_ADDRESS.get(USDC).address.toLowerCase();
-const LINK_FEED = PRICE_FEED_BY_ADDRESS.get(LINK).address.toLowerCase();
-const DAI_FEED = PRICE_FEED_BY_ADDRESS.get(DAI).address.toLowerCase();
-
-// What each feed answers, by its lowercased address: the price in the feed's
-// own units and the time it was written. A feed that is not here makes the
-// call fail.
-let rounds;
-// The parsed body of every HTTP request the node received.
-let requests;
-let logged;
-
-function round(answer, updatedAt = NOW_SECONDS) {
-    return { answer, updatedAt };
-}
-
-// One JSON-RPC answer, to a latestRoundData() call.
-function reply(req) {
-    const envelope = { jsonrpc: "2.0", id: req.id };
-    const answer = rounds[req.params[0].to.toLowerCase()];
-    if (!answer) {
-        return {
-            ...envelope,
-            error: { code: -32000, message: "fixture: read failed" },
-        };
-    }
-    return {
-        ...envelope,
-        result: AbiCoder.defaultAbiCoder().encode(
-            ["uint80", "int256", "uint256", "uint256", "uint80"],
-            [1, answer.answer, answer.updatedAt, answer.updatedAt, 1],
-        ),
-    };
-}
-
-// The feed addresses one HTTP request read, sorted.
-function feedsRead(body) {
-    return [body]
-        .flat()
-        .map((req) => req.params[0].to.toLowerCase())
-        .sort();
-}
-
-// One address that holds `held`, a list of [contract address, symbol].
-function holdTokens(held) {
-    state.wallets = [
-        {
-            addresses: [
-                {
-                    address: "0x" + "a".repeat(40),
-                    balance: "1.0",
-                    tokenBalances: held.map(([address, symbol]) => ({
-                        address,
-                        symbol,
-                        balance: "10.0",
-                    })),
-                },
-            ],
-        },
-    ];
-}
-
-beforeEach(() => {
-    clearPrices();
-    state.networkId = "mainnet";
-    state.rpcUrl = RPC_URL;
-    state.wallets = [];
-    state.trackedTokens = [];
-    rounds = { [ETH_FEED]: round(2000n * 10n ** 8n) };
-    requests = [];
-    logged = [];
-    jest.spyOn(Date, "now").mockReturnValue(NOW);
-    for (const level of ["error", "warn"]) {
-        jest.spyOn(console, level).mockImplementation((...args) => {
-            logged.push(args.map(String).join(" "));
-        });
-    }
-    FetchRequest.registerGetUrl(async (req) => {
-        const body = JSON.parse(Buffer.from(req.body).toString("utf8"));
-        requests.push(body);
-        const answer = Array.isArray(body) ? body.map(reply) : reply(body);
-        return {
-            statusCode: 200,
-            statusMessage: "OK",
-            headers: { "content-type": "application/json" },
-            body: Buffer.from(JSON.stringify(answer)),
-        };
-    });
-});
-
-afterEach(() => {
-    FetchRequest.registerGetUrl(FetchRequest.createGetUrlFunc());
-    jest.restoreAllMocks();
-    clearPrices();
-});
-
-describe("refreshPrices", () => {
-    test("reads ETH and each held or tracked token that has a feed in one HTTP request", async () => {
-        holdTokens([
-            [USDC, "USDC"],
-            [LINK, "LINK"],
-        ]);
-        state.trackedTokens = [{ address: DAI, symbol: "DAI", decimals: 18 }];
-        rounds[USDC_FEED] = round(10n ** 8n);
-        rounds[LINK_FEED] = round(1150000000n);
-        rounds[DAI_FEED] = round(99990000n);
-
-        await refreshPrices();
-
-        expect(requests).toHaveLength(1);
-        expect(feedsRead(requests[0])).toEqual(
-            [ETH_FEED, USDC_FEED, LINK_FEED, DAI_FEED].sort(),
-        );
-        expect(getPrice("ETH")).toBe(2000);
-        expect(getPrice(USDC)).toBe(1);
-        expect(getPrice(LINK)).toBe(11.5);
-        expect(getPrice(DAI)).toBe(0.9999);
-    });
-
-    test("reads again only once 5 minutes have passed", async () => {
-        await refreshPrices();
-        Date.now.mockReturnValue(NOW + 299999);
-        await refreshPrices();
-        expect(requests).toHaveLength(1);
-
-        Date.now.mockReturnValue(NOW + 300000);
-        rounds[ETH_FEED] = round(2100n * 10n ** 8n, NOW_SECONDS + 300);
-        await refreshPrices();
-        expect(requests).toHaveLength(2);
-        expect(getPrice("ETH")).toBe(2100);
-    });
-
-    test("on Sepolia, reads nothing and keeps no price", async () => {
-        await refreshPrices();
-        expect(getPrice("ETH")).toBe(2000);
-
-        state.networkId = "sepolia";
-        await refreshPrices();
-        expect(requests).toHaveLength(1);
-        expect(Object.keys(prices)).toEqual([]);
-    });
-});
-
-describe("pairing by contract address", () => {
-    test("a token that copies a bundled token's symbol gets no price", async () => {
-        holdTokens([
-            [USDC, "USDC"],
-            [FAKE_USDC, "USDC"],
-        ]);
-        rounds[USDC_FEED] = round(10n ** 8n);
-
-        await refreshPrices();
-
-        expect(feedsRead(requests[0])).toEqual([ETH_FEED, USDC_FEED].sort());
-        expect(getPrice(USDC)).toBe(1);
-        expect(getPrice(FAKE_USDC)).toBeNull();
-        // 1 ETH and 10 real USDC are priced; the 10 look-alikes are not.
-        expect(getAddressValue(state.wallets[0].addresses[0])).toEqual({
-            usd: 2010,
-            partial: true,
-        });
-    });
-});
-
-describe("freshness", () => {
-    test("a reading older than its feed's heartbeat plus 30 minutes is no price", async () => {
-        const heartbeatAgo =
-            NOW_SECONDS - PRICE_FEED_BY_ADDRESS.get(USDC).heartbeat;
-        holdTokens([[USDC, "USDC"]]);
-
-        rounds[USDC_FEED] = round(10n ** 8n, heartbeatAgo - 1800 - 1);
-        await refreshPrices();
-        expect(getPrice(USDC)).toBeNull();
-
-        clearPrices();
-        rounds[USDC_FEED] = round(10n ** 8n, heartbeatAgo - 1800);
-        await refreshPrices();
-        expect(getPrice(USDC)).toBe(1);
-    });
-
-    test.each([0n, -1n])("an answer of %s is no price", async (answer) => {
-        rounds[ETH_FEED] = round(answer);
-        await refreshPrices();
-        expect(getPrice("ETH")).toBeNull();
-    });
-});
-
-describe("a failed read", () => {
-    test("leaves the token with no price and is logged with its error", async () => {
-        holdTokens([[USDC, "USDC"]]);
-        rounds[USDC_FEED] = round(10n ** 8n);
-        await refreshPrices();
-        expect(getPrice(USDC)).toBe(1);
-
-        Date.now.mockReturnValue(NOW + 300000);
-        delete rounds[USDC_FEED];
-        await refreshPrices();
-
-        expect(getPrice(USDC)).toBeNull();
-        expect(getPrice("ETH")).toBe(2000);
-        expect(
-            logged.some(
-                (line) =>
-                    line.includes("price feed read failed") &&
-                    line.includes(USDC),
-            ),
-        ).toBe(true);
-    });
-
-    test("an HTTP error is logged with its status", async () => {
-        FetchRequest.registerGetUrl(async () => ({
-            statusCode: 401,
-            statusMessage: "Unauthorized",
-            headers: { "content-type": "text/plain" },
-            body: Buffer.from("API key required"),
-        }));
-
-        await refreshPrices();
-
-        expect(getPrice("ETH")).toBeNull();
-        expect(logged.some((line) => line.includes("401"))).toBe(true);
-    });
-});
-
-describe("the feed table", () => {
-    test("names each token by its address as the bundled list spells it", () => {
-        const listed = new Set(TOKENS.map((t) => t.address));
-        const unlisted = Object.keys(USD_PRICE_FEEDS).filter(
-            (address) => !listed.has(address),
-        );
-        expect(unlisted).toEqual([]);
-    });
-});

tests/refreshDuringRefresh.test.js

@@ -1,157 +0,0 @@
-// While a refresh runs, a request through ctx is not dropped. One more refresh
-// runs once the running one ends, however many were asked for in that time
-// (https://git.eeqj.de/sneak/AutistMask/issues/581). A tick of the ten-second
-// timer that finds a refresh running is dropped. Each test boots the real popup
-// over a stored profile and holds the ten-second refresh open. `readChain()`
-// sets each address's balance from `CHAIN`, as the real `refreshBalances()`
-// sets it from the node.
-
-const {
-    bootPopup,
-    cleanupPopup,
-    unversionedValidProfile,
-    ADDRESS,
-} = require("./support/popupBoot");
-const {
-    hdWalletFromMnemonic,
-    deriveAddressFromXpub,
-} = require("../src/shared/wallet");
-
-const PHRASE =
-    "abandon abandon abandon abandon abandon abandon " +
-    "abandon abandon abandon abandon abandon about";
-const PASSWORD = "correct horse battery staple";
-
-// The first two addresses of PHRASE, both used on the chain.
-const { xpub, firstAddress } = hdWalletFromMnemonic(PHRASE);
-const SECOND_ADDRESS = deriveAddressFromXpub(xpub, 1);
-
-// The ETH balance the chain holds for each address, in ether.
-const CHAIN = {
-    [ADDRESS]: "1.5",
-    [firstAddress]: "2.0",
-    [SECOND_ADDRESS]: "3.0",
-};
-
-afterEach(() => {
-    cleanupPopup();
-});
-
-// The balance stand-in for a refresh that returns.
-async function readChain(wallets) {
-    for (const wallet of wallets) {
-        for (const addr of wallet.addresses) {
-            addr.balance = CHAIN[addr.address];
-        }
-    }
-}
-
-// Boots the popup over a profile with one wallet. From then on,
-// `refreshBalances()` never returns unless the test answers it. So an unwanted
-// refresh is counted once and then waits, instead of starting more.
-async function boot() {
-    const page = await bootPopup(unversionedValidProfile());
-    expect(page.pageErrors).toEqual([]);
-    const { refreshBalances } = require("../src/shared/balances");
-    refreshBalances.mockImplementation(() => new Promise(() => {}));
-    return { page, refreshBalances };
-}
-
-// Starts the ten-second refresh and holds it open until finish() is called.
-// The held refresh then writes the chain's balances. finish() resolves once
-// the held refresh has saved them and drawn Home. The one refresh after the
-// held one also returns.
-async function holdRefresh(page) {
-    const { refreshBalances } = require("../src/shared/balances");
-    let answer;
-    refreshBalances
-        .mockImplementationOnce(async (wallets) => {
-            await new Promise((resolve) => {
-                answer = resolve;
-            });
-            await readChain(wallets);
-        })
-        .mockImplementationOnce(readChain);
-    const ticking = page.tick();
-    await page.settle();
-    return {
-        finish: async () => {
-            answer();
-            await ticking;
-        },
-    };
-}
-
-// Imports PHRASE on AddWallet. Its address scan finds the phrase's first two
-// addresses.
-async function importPhrase(page) {
-    const { scanForAddresses } = require("../src/shared/balances");
-    scanForAddresses.mockImplementationOnce(async () => ({
-        addresses: [
-            { address: firstAddress, index: 0 },
-            { address: SECOND_ADDRESS, index: 1 },
-        ],
-        nextIndex: 2,
-    }));
-    await page.click("btn-add-wallet-bottom");
-    await page.click("tab-mnemonic");
-    page.node("wallet-mnemonic").value = PHRASE;
-    page.node("add-wallet-password").value = PASSWORD;
-    page.node("add-wallet-password-confirm").value = PASSWORD;
-    await page.click("btn-add-wallet-confirm");
-}
-
-// Imports the private key `key` on AddWallet.
-async function importKey(page, key) {
-    await page.click("btn-add-wallet-bottom");
-    await page.click("tab-privkey");
-    page.node("import-private-key").value = key;
-    page.node("add-wallet-password").value = PASSWORD;
-    page.node("add-wallet-password-confirm").value = PASSWORD;
-    await page.click("btn-add-wallet-confirm");
-}
-
-test("addresses that an import finds during a refresh show their balances once one more refresh returns", async () => {
-    const { page } = await boot();
-    const refresh = await holdRefresh(page);
-
-    await importPhrase(page);
-    expect(page.visibleViews()).toEqual(["main"]);
-    expect(page.text("flash-msg")).toBe("Found 2 addresses.");
-
-    await refresh.finish();
-    await page.settle();
-
-    const list = page.node("wallet-list").innerHTML;
-    expect(list).toContain("<span>2.0000</span>");
-    expect(list).toContain("<span>3.0000</span>");
-});
-
-test("several requests during a refresh lead to exactly one more refresh", async () => {
-    const { page, refreshBalances } = await boot();
-    const refresh = await holdRefresh(page);
-    const calls = refreshBalances.mock.calls.length;
-
-    await importKey(page, "0x" + "11".repeat(32));
-    await importKey(page, "0x" + "22".repeat(32));
-    await importPhrase(page);
-    expect(refreshBalances).toHaveBeenCalledTimes(calls);
-
-    await refresh.finish();
-    await page.settle();
-
-    expect(refreshBalances).toHaveBeenCalledTimes(calls + 1);
-});
-
-test("a tick of the ten-second timer during a refresh starts no other refresh", async () => {
-    const { page, refreshBalances } = await boot();
-    const refresh = await holdRefresh(page);
-    const calls = refreshBalances.mock.calls.length;
-
-    await page.tick();
-
-    await refresh.finish();
-    await page.settle();
-
-    expect(refreshBalances).toHaveBeenCalledTimes(calls);
-});

tests/resolveTokenSymbol.test.js

@@ -67,15 +67,13 @@ beforeEach(() => {
 });
 
 describe("resolveTokenSymbol", () => {
-    // The bundled list is read only for a token on Ethereum Mainnet.
     test("reads the bundled list", () => {
-        expect(resolveTokenSymbol(USDC, { chainId: "0x1" })).toBe("USDC");
+        expect(resolveTokenSymbol(USDC, state)).toBe("USDC");
     });
 
     test("prefers the bundled list over a tracked entry", () => {
         state.trackedTokens = [{ address: USDC, symbol: "NOTUSDC" }];
-        const sources = { chainId: "0x1", trackedTokens: state.trackedTokens };
-        expect(resolveTokenSymbol(USDC, sources)).toBe("USDC");
+        expect(resolveTokenSymbol(USDC, state)).toBe("USDC");
     });
 
     test("reads a token the user tracks", () => {
@@ -106,19 +104,7 @@ describe("resolveTokenSymbol", () => {
     test("rejects a tracked entry claiming a bundled ticker it is not", () => {
         // NOVEL_TOKEN is not the real USDC contract, so it may not wear USDC.
         state.trackedTokens = [{ address: NOVEL_TOKEN, symbol: "USDC" }];
-        const sources = { chainId: "0x1", trackedTokens: state.trackedTokens };
-        expect(resolveTokenSymbol(NOVEL_TOKEN, sources)).toBeNull();
-    });
-
-    // The bundled list holds mainnet contracts, so on Sepolia any contract may
-    // carry one of its symbols.
-    test("on Sepolia, reads a tracked entry carrying a bundled ticker", () => {
-        state.trackedTokens = [{ address: NOVEL_TOKEN, symbol: "USDC" }];
-        const sources = {
-            chainId: "0xaa36a7",
-            trackedTokens: state.trackedTokens,
-        };
-        expect(resolveTokenSymbol(NOVEL_TOKEN, sources)).toBe("USDC");
+        expect(resolveTokenSymbol(NOVEL_TOKEN, state)).toBeNull();
     });
 
     test("rejects an explorer entry claiming the native ETH ticker", () => {

tests/settingsEndpointSave.test.js

@@ -1,169 +0,0 @@
-// Another page stores a different RPC or Blockscout URL for the same network.
-// Then the user taps "Save" in Settings on this page, on the URL that this page
-// loaded. The URL on screen is stored, and the flash message reads "Saved."
-// (https://git.eeqj.de/sneak/AutistMask/issues/688). Driven through the real
-// popup over a stored profile on Ethereum Mainnet.
-
-const {
-    bootPopup,
-    cleanupPopup,
-    unversionedValidProfile,
-} = require("./support/popupBoot");
-const { NETWORKS } = require("../src/shared/networks");
-
-afterEach(() => {
-    cleanupPopup();
-});
-
-test.each([
-    { button: "btn-save-rpc", input: "settings-rpc", field: "rpcUrl" },
-    {
-        button: "btn-save-blockscout",
-        input: "settings-blockscout",
-        field: "blockscoutUrl",
-    },
-])(
-    "$button stores the URL on screen after another page stored a different one",
-    async ({ button, input, field }) => {
-        const page = await bootPopup(unversionedValidProfile());
-        await page.click("btn-settings");
-        const url = page.value(input);
-        // This write sends this page no storage change event.
-        page.storage.write("autistmask", {
-            ...page.storage.read("autistmask"),
-            [field]: "https://other-page.example.invalid",
-        });
-        // This answer passes both endpoint checks on Ethereum Mainnet. The RPC
-        // check reads Ethereum Mainnet's chain id from it. The Blockscout check
-        // reads `ok`.
-        globalThis.fetch.mockResolvedValue({
-            ok: true,
-            json: async () => ({ result: NETWORKS.mainnet.chainId }),
-        });
-
-        await page.click(button);
-
-        expect(page.storage.read("autistmask")[field]).toBe(url);
-        expect(page.text("flash-msg")).toBe("Saved.");
-    },
-);
-
-// The user types a URL in Settings and taps "Save". While the check waits for
-// the endpoint's answer, another page turns "Use Blockscout" on. This page
-// follows that change and draws Settings again, with the stored URL in the
-// input. The check then passes. The typed URL is not stored. The flash message
-// says that the URL was changed during the check
-// (https://git.eeqj.de/sneak/AutistMask/issues/695).
-test.each([
-    { button: "btn-save-rpc", input: "settings-rpc", field: "rpcUrl" },
-    {
-        button: "btn-save-blockscout",
-        input: "settings-blockscout",
-        field: "blockscoutUrl",
-    },
-])(
-    "$button stores nothing when Settings is drawn again during the check",
-    async ({ button, input, field }) => {
-        const page = await bootPopup(unversionedValidProfile());
-        await page.click("btn-settings");
-        const storedUrl = page.value(input);
-        let answer;
-        globalThis.fetch.mockReturnValue(
-            new Promise((resolve) => {
-                answer = resolve;
-            }),
-        );
-
-        page.node(input).value = "https://typed.example.invalid";
-        const saving = page.node(button).listeners.click.map((fn) => fn());
-        await page.settle();
-        // The browser announces this write to this page.
-        await page.storage.local.set({
-            autistmask: {
-                ...page.storage.read("autistmask"),
-                useBlockscout: true,
-            },
-        });
-        await page.settle();
-        expect(page.node("settings-use-blockscout").checked).toBe(true);
-        // This answer passes both endpoint checks on Ethereum Mainnet.
-        answer({
-            ok: true,
-            json: async () => ({ result: NETWORKS.mainnet.chainId }),
-        });
-        await Promise.all(saving);
-        await page.settle();
-
-        expect(page.storage.read("autistmask")[field]).toBe(storedUrl);
-        expect(page.value(input)).toBe(storedUrl);
-        expect(page.text("flash-msg")).toBe(
-            "The URL was not saved because it was changed during the check.",
-        );
-    },
-);
-
-// As above, but another write holds the lock. So this page's follow of the
-// change to "Use Blockscout" waits for the lock. The endpoint answers while the
-// input still shows the typed URL. The save then asks for the lock, after the
-// follow did. So the follow draws Settings again before the save compares the
-// input.
-test.each([
-    { button: "btn-save-rpc", input: "settings-rpc", field: "rpcUrl" },
-    {
-        button: "btn-save-blockscout",
-        input: "settings-blockscout",
-        field: "blockscoutUrl",
-    },
-])(
-    "$button stores nothing when Settings is drawn again while the save waits for the lock",
-    async ({ button, input, field }) => {
-        const page = await bootPopup(unversionedValidProfile());
-        await page.click("btn-settings");
-        const storedUrl = page.value(input);
-        let answer;
-        globalThis.fetch.mockReturnValue(
-            new Promise((resolve) => {
-                answer = resolve;
-            }),
-        );
-        const typedUrl = "https://typed.example.invalid";
-
-        page.node(input).value = typedUrl;
-        const saving = page.node(button).listeners.click.map((fn) => fn());
-        await page.settle();
-        let releaseLock;
-        const lockHeld = navigator.locks.request(
-            "autistmask",
-            () =>
-                new Promise((resolve) => {
-                    releaseLock = resolve;
-                }),
-        );
-        // The browser announces this write to this page.
-        await page.storage.local.set({
-            autistmask: {
-                ...page.storage.read("autistmask"),
-                useBlockscout: true,
-            },
-        });
-        await page.settle();
-        // This answer passes both endpoint checks on Ethereum Mainnet.
-        answer({
-            ok: true,
-            json: async () => ({ result: NETWORKS.mainnet.chainId }),
-        });
-        await page.settle();
-        expect(page.value(input)).toBe(typedUrl);
-        releaseLock();
-        await lockHeld;
-        await Promise.all(saving);
-        await page.settle();
-
-        expect(page.node("settings-use-blockscout").checked).toBe(true);
-        expect(page.storage.read("autistmask")[field]).toBe(storedUrl);
-        expect(page.value(input)).toBe(storedUrl);
-        expect(page.text("flash-msg")).toBe(
-            "The URL was not saved because it was changed during the check.",
-        );
-    },
-);

tests/symbolSpoof.test.js

@@ -72,11 +72,6 @@ const {
 const { renderSendTokenSelect } = require("../src/popup/views/send");
 const { state } = require("../src/shared/state");
 const { debugFetch } = require("../src/shared/log");
-const { NETWORKS } = require("../src/shared/networks");
-
-// The bundled list's symbols are known symbols only on Ethereum Mainnet.
-const MAINNET = NETWORKS.mainnet.chainId;
-const SEPOLIA = NETWORKS.sepolia.chainId;
 
 // The fake "Ethereum" token with symbol "ETH" from the attack documented in
 // README.md, given a holder count high enough to clear every other filter so
@@ -121,29 +116,14 @@ describe("the shared rule", () => {
     });
 
     test("a known symbol from its own contract is not a spoof", () => {
-        expect(isSpoofedSymbol("USDC", USDC_CONTRACT, MAINNET)).toBe(false);
-        expect(
-            isSpoofedSymbol("usdc", USDC_CONTRACT.toUpperCase(), MAINNET),
-        ).toBe(false);
+        expect(isSpoofedSymbol("USDC", USDC_CONTRACT)).toBe(false);
+        expect(isSpoofedSymbol("usdc", USDC_CONTRACT.toUpperCase())).toBe(
+            false,
+        );
     });
 
     test("a known symbol from another contract is a spoof", () => {
-        expect(isSpoofedSymbol("USDC", FAKE_ETH_CONTRACT, MAINNET)).toBe(true);
-    });
-
-    // https://git.eeqj.de/sneak/AutistMask/issues/632: the bundled list holds
-    // mainnet contracts, so on Sepolia any contract may carry one of its
-    // symbols.
-    test("on Sepolia, a bundled symbol from any contract is not a spoof", () => {
-        expect(isSpoofedSymbol("USDC", FAKE_ETH_CONTRACT, SEPOLIA)).toBe(false);
-        expect(isSpoofedSymbol("USDC", USDC_CONTRACT, SEPOLIA)).toBe(false);
-    });
-
-    test("on Sepolia, the native asset's labels are still reserved", () => {
-        expect(isSpoofedSymbol("ETH", FAKE_ETH_CONTRACT, SEPOLIA)).toBe(true);
-        expect(isSpoofedSymbol("SepoliaETH", FAKE_ETH_CONTRACT, SEPOLIA)).toBe(
-            true,
-        );
+        expect(isSpoofedSymbol("USDC", FAKE_ETH_CONTRACT)).toBe(true);
     });
 
     test("a symbol that is not in the table is not judged here", () => {
@@ -184,9 +164,7 @@ describe("the shared rule: symbols that render as a known symbol", () => {
     test("ASCII padding does not buy a pass", () => {
         expect(isSpoofedSymbol(" ETH ", FAKE_ETH_CONTRACT)).toBe(true);
         expect(isSpoofedSymbol("\tETH\n", FAKE_ETH_CONTRACT)).toBe(true);
-        expect(isSpoofedSymbol("  usdc  ", FAKE_ETH_CONTRACT, MAINNET)).toBe(
-            true,
-        );
+        expect(isSpoofedSymbol("  usdc  ", FAKE_ETH_CONTRACT)).toBe(true);
     });
 
     test("non-breaking and other Unicode spaces do not either", () => {
@@ -265,9 +243,7 @@ describe("the shared rule: symbols that render as a known symbol", () => {
 
     test("compatibility forms fold onto the symbol they imitate", () => {
         expect(isSpoofedSymbol(FULLWIDTH_ETH, FAKE_ETH_CONTRACT)).toBe(true);
-        expect(
-            isSpoofedSymbol(FULLWIDTH_USDC, FAKE_ETH_CONTRACT, MAINNET),
-        ).toBe(true);
+        expect(isSpoofedSymbol(FULLWIDTH_USDC, FAKE_ETH_CONTRACT)).toBe(true);
     });
 
     // The two knowingly open classes, asserted here so that the boundary is
@@ -295,10 +271,8 @@ describe("the shared rule: symbols that render as a known symbol", () => {
     });
 
     test("a genuine contract still bears its own padded symbol", () => {
-        expect(isSpoofedSymbol(" USDC ", USDC_CONTRACT, MAINNET)).toBe(false);
-        expect(isSpoofedSymbol(ZWSP + "WETH", WETH_CONTRACT, MAINNET)).toBe(
-            false,
-        );
+        expect(isSpoofedSymbol(" USDC ", USDC_CONTRACT)).toBe(false);
+        expect(isSpoofedSymbol(ZWSP + "WETH", WETH_CONTRACT)).toBe(false);
     });
 
     // Normalization must not invent a match.  Interior ASCII whitespace is
@@ -322,7 +296,7 @@ describe("the shared rule: symbols that render as a known symbol", () => {
             expect(symbol).toMatch(/^[!-~]+$/);
             if (addresses === null) continue;
             for (const address of addresses) {
-                expect(isSpoofedSymbol(symbol, address, MAINNET)).toBe(false);
+                expect(isSpoofedSymbol(symbol, address)).toBe(false);
             }
         }
     });
@@ -343,7 +317,7 @@ describe("the shared rule: symbols that render as a known symbol", () => {
 describe("the shipped token list", () => {
     test("no bundled token is filtered at its own address", () => {
         const filtered = TOKENS.filter((t) =>
-            isSpoofedSymbol(t.symbol, t.address, MAINNET),
+            isSpoofedSymbol(t.symbol, t.address),
         ).map((t) => t.symbol + " @ " + t.address);
         expect(filtered).toEqual([]);
     });
@@ -386,9 +360,7 @@ describe("the shipped token list", () => {
         expect(shared.length).toBeGreaterThan(0);
         for (const [, list] of shared) {
             for (const t of list) {
-                expect(isSpoofedSymbol(t.symbol, t.address, MAINNET)).toBe(
-                    false,
-                );
+                expect(isSpoofedSymbol(t.symbol, t.address)).toBe(false);
             }
         }
     });
@@ -432,7 +404,7 @@ describe("the shipped token list", () => {
                 [...addresses].sort(),
             );
             for (const address of addresses) {
-                expect(isSpoofedSymbol(symbol, address, MAINNET)).toBe(false);
+                expect(isSpoofedSymbol(symbol, address)).toBe(false);
             }
         }
     });
@@ -449,9 +421,7 @@ describe("the shipped token list", () => {
         }
         for (const [symbol, list] of bySymbol) {
             if (list.length < 2) continue;
-            expect(isSpoofedSymbol(symbol, FAKE_ETH_CONTRACT, MAINNET)).toBe(
-                true,
-            );
+            expect(isSpoofedSymbol(symbol, FAKE_ETH_CONTRACT)).toBe(true);
         }
     });
 });
@@ -536,40 +506,10 @@ describe("surface 2: the Send token selector", () => {
     }
 
     beforeEach(() => {
-        state.networkId = "mainnet";
         state.fraudContracts = [];
         state.hideLowHolderTokens = true;
     });
 
-    afterAll(() => {
-        state.networkId = "mainnet";
-    });
-
-    // A token reporting USDC's symbol from another contract.
-    function otherUsdc() {
-        return {
-            address: FAKE_ETH_CONTRACT,
-            symbol: "USDC",
-            decimals: 6,
-            balance: "12.5",
-            holders: 900000,
-        };
-    }
-
-    test("a bundled symbol from another contract is not selectable", () => {
-        render([otherUsdc()]);
-        expect(select.children).toEqual([]);
-    });
-
-    // https://git.eeqj.de/sneak/AutistMask/issues/632: the bundled list holds
-    // mainnet contracts, so on Sepolia any contract may carry its symbols.
-    test("with Sepolia active, a bundled symbol from another contract is selectable", () => {
-        state.networkId = "sepolia";
-        render([otherUsdc()]);
-        expect(select.children).toHaveLength(1);
-        expect(select.children[0].value).toBe(FAKE_ETH_CONTRACT);
-    });
-
     test("a fake ETH token is not selectable", () => {
         render([
             {
@@ -687,12 +627,7 @@ describe("surface 3: the balance list", () => {
                 decimals: "6",
             }),
         ]);
-        const balances = await fetchTokenBalances(
-            HOLDER,
-            BLOCKSCOUT,
-            [],
-            MAINNET,
-        );
+        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, []);
         expect(balances).toHaveLength(1);
         expect(balances[0].symbol).toBe(" USDC ");
     });
@@ -706,40 +641,11 @@ describe("surface 3: the balance list", () => {
                 decimals: "6",
             }),
         ]);
-        const balances = await fetchTokenBalances(
-            HOLDER,
-            BLOCKSCOUT,
-            [],
-            MAINNET,
-        );
+        const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, []);
         expect(balances).toHaveLength(1);
         expect(balances[0].symbol).toBe("USDC");
     });
 
-    // https://git.eeqj.de/sneak/AutistMask/issues/632: the bundled list holds
-    // mainnet contracts, so on Sepolia any contract may carry its symbols.
-    test("a bundled symbol from another contract is listed on Sepolia only", async () => {
-        respondWith([fakeEthItem({ symbol: "USDC", decimals: "6" })]);
-        expect(
-            await fetchTokenBalances(HOLDER, BLOCKSCOUT, [], MAINNET),
-        ).toEqual([]);
-        const sepolia = await fetchTokenBalances(
-            HOLDER,
-            BLOCKSCOUT,
-            [],
-            SEPOLIA,
-        );
-        expect(sepolia).toHaveLength(1);
-        expect(sepolia[0].symbol).toBe("USDC");
-    });
-
-    test("a fake ETH token is filtered on Sepolia too", async () => {
-        respondWith([fakeEthItem()]);
-        expect(
-            await fetchTokenBalances(HOLDER, BLOCKSCOUT, [], SEPOLIA),
-        ).toEqual([]);
-    });
-
     // The trap in this change: the user's real ETH balance is not an ERC-20
     // and is fetched over RPC in refreshBalances, so it never passes through
     // this loop at all.  An explorer row that is not an ERC-20 is dropped

tests/trackedTokenBalances.test.js

@@ -133,13 +133,13 @@ function trackedRow(balance, decimals = null, holders = null) {
     };
 }
 
-async function refresh(addresses, trackedTokens, networkId = "mainnet") {
+async function refresh(addresses, trackedTokens) {
     await refreshBalances(
         [{ addresses }],
         RPC_URL,
         EXPLORER_URL,
         trackedTokens,
-        networkId,
+        "mainnet",
         new AbortController().signal,
     );
     return addresses;
@@ -307,76 +307,3 @@ test("a tracked token wearing a known symbol from another contract is not listed
     );
     expect(first.tokenBalances).toEqual([]);
 });
-
-// https://git.eeqj.de/sneak/AutistMask/issues/632: the bundled list holds
-// Ethereum Mainnet contracts. A token outside the tracked tokens with an
-// unknown holder count is listed only when the bundled list names it.
-test("an untracked bundled token with an unknown holder count is listed on Ethereum Mainnet only", async () => {
-    explorerRows = [explorerRow(USDC, "USDC", 5000000, null)];
-    const [mainnet] = await refresh(
-        [{ address: FIRST, tokenBalances: [] }],
-        [],
-    );
-    expect(mainnet.tokenBalances).toEqual([
-        {
-            address: USDC,
-            name: "USDC",
-            symbol: "USDC",
-            decimals: 6,
-            balance: "5.0",
-            holders: null,
-        },
-    ]);
-    const [sepolia] = await refresh(
-        [{ address: FIRST, tokenBalances: [] }],
-        [],
-        "sepolia",
-    );
-    expect(sepolia.tokenBalances).toEqual([]);
-});
-
-test("a tracked token at a bundled token's address takes the bundled scale on Ethereum Mainnet only", async () => {
-    holdings[USDC] = { [FIRST]: 5000000n };
-    // The tracked entry records no decimals, and Blockscout fails.
-    const tracked = [
-        { address: USDC, symbol: "USDC", name: "USD Coin", decimals: null },
-    ];
-    const row = (balance) => ({
-        address: USDC,
-        name: "USD Coin",
-        symbol: "USDC",
-        decimals: null,
-        balance: balance,
-        holders: null,
-    });
-    const [mainnet] = await refresh(
-        [{ address: FIRST, tokenBalances: [] }],
-        tracked,
-    );
-    expect(mainnet.tokenBalances).toEqual([row("5.0")]);
-    const [sepolia] = await refresh(
-        [{ address: FIRST, tokenBalances: [] }],
-        tracked,
-        "sepolia",
-    );
-    expect(sepolia.tokenBalances).toEqual([row(null)]);
-});
-
-test("with Sepolia active, a tracked token wearing a bundled symbol from another contract is listed", async () => {
-    holdings[OTHER] = { [FIRST]: 5000000n };
-    const [first] = await refresh(
-        [{ address: FIRST, tokenBalances: [] }],
-        [{ address: OTHER, symbol: "USDC", name: "Other", decimals: 6 }],
-        "sepolia",
-    );
-    expect(first.tokenBalances).toEqual([
-        {
-            address: OTHER,
-            name: "Other",
-            symbol: "USDC",
-            decimals: null,
-            balance: "5.0",
-            holders: null,
-        },
-    ]);
-});

tests/trackedTokensPerNetwork.test.js

@@ -5,9 +5,6 @@
 // a contract lookup that answers after one. Driven through the real popup over
 // a stored profile; the same switch made by the background is in
 // tests/coldWorkerChainSwitch.test.js.
-//
-// The tests of what another page stored before a switch in Settings cover a
-// fraud contract too (https://git.eeqj.de/sneak/AutistMask/issues/692).
 
 const {
     bootPopup,
@@ -180,164 +177,6 @@ test("a token added by contract address on Sepolia is tracked on Sepolia only",
     expect(onSepolia).not.toContain("DAI");
 });
 
-// Another popup page tracks DAI on Ethereum Mainnet after this page's last
-// save. The switch to Sepolia puts DAI away under Ethereum Mainnet.
-test("a token another page tracked before a switch in Settings stays tracked on Ethereum Mainnet", async () => {
-    const boot = await bootPopup(unversionedValidProfile());
-    expect(boot.pageErrors).toEqual([]);
-    boot.storage.write("autistmask", {
-        ...boot.storage.read("autistmask"),
-        trackedTokens: [MAINNET_TOKEN],
-    });
-
-    await boot.click("btn-settings");
-    await chooseNetwork(boot, "sepolia");
-
-    const stored = boot.storage.read("autistmask");
-    expect(stored.networkId).toBe("sepolia");
-    expect(stored.trackedTokens).toEqual([]);
-    expect(stored.networkTrackedTokens.mainnet).toEqual([MAINNET_TOKEN]);
-});
-
-// Another popup page stops tracking DAI on Ethereum Mainnet after this page's
-// last save. This page still holds DAI. The switch to Sepolia does not store
-// DAI under Ethereum Mainnet again.
-test("a token another page removed before a switch in Settings stays removed", async () => {
-    const boot = await bootPopup(
-        unversionedValidProfile({ trackedTokens: [MAINNET_TOKEN] }),
-    );
-    expect(boot.pageErrors).toEqual([]);
-    boot.storage.write("autistmask", {
-        ...boot.storage.read("autistmask"),
-        trackedTokens: [],
-    });
-
-    await boot.click("btn-settings");
-    await chooseNetwork(boot, "sepolia");
-
-    const stored = boot.storage.read("autistmask");
-    expect(stored.networkId).toBe("sepolia");
-    expect(stored.trackedTokens).toEqual([]);
-    expect(stored.networkTrackedTokens.mainnet).toEqual([]);
-});
-
-// Another popup page removes DAI after this page's last save. That page then
-// adds DAI again, typing the contract address in lower case. The two pages'
-// entries for DAI match, because contract addresses are compared ignoring
-// letter case. The switch to Sepolia keeps this page's entry under Ethereum
-// Mainnet.
-test("a token another page added again with a lower-case address keeps this page's entry", async () => {
-    const boot = await bootPopup(
-        unversionedValidProfile({ trackedTokens: [MAINNET_TOKEN] }),
-    );
-    expect(boot.pageErrors).toEqual([]);
-    boot.storage.write("autistmask", {
-        ...boot.storage.read("autistmask"),
-        trackedTokens: [
-            { ...MAINNET_TOKEN, address: MAINNET_TOKEN.address.toLowerCase() },
-        ],
-    });
-
-    await boot.click("btn-settings");
-    await chooseNetwork(boot, "sepolia");
-
-    const stored = boot.storage.read("autistmask");
-    expect(stored.networkId).toBe("sepolia");
-    expect(stored.networkTrackedTokens.mainnet).toEqual([MAINNET_TOKEN]);
-});
-
-// Another popup page saves a switch to Sepolia after this page's last save.
-// TST is tracked on Sepolia. This page has not taken that switch yet. A switch
-// to Sepolia in this page's Settings keeps TST off Ethereum Mainnet's list.
-test("a token tracked on Sepolia when another page switched there is not tracked on Ethereum Mainnet", async () => {
-    const boot = await bootPopup(unversionedValidProfile());
-    expect(boot.pageErrors).toEqual([]);
-    await boot.click("btn-settings");
-    boot.storage.write("autistmask", {
-        ...boot.storage.read("autistmask"),
-        networkId: "sepolia",
-        trackedTokens: [SEPOLIA_TOKEN],
-    });
-
-    await chooseNetwork(boot, "sepolia");
-
-    const stored = boot.storage.read("autistmask");
-    expect(stored.networkId).toBe("sepolia");
-    expect(stored.trackedTokens).toEqual([SEPOLIA_TOKEN]);
-    expect(stored.networkTrackedTokens.mainnet).toEqual([]);
-});
-
-// Another popup page records a fraud contract on Ethereum Mainnet after this
-// page's last save. The switch to Sepolia drops that fraud contract, as the
-// switch drops this page's own.
-test("a fraud contract another page recorded before a switch in Settings is not kept on Sepolia", async () => {
-    const boot = await bootPopup(unversionedValidProfile());
-    expect(boot.pageErrors).toEqual([]);
-    boot.storage.write("autistmask", {
-        ...boot.storage.read("autistmask"),
-        fraudContracts: [NEW_TOKEN_ADDRESS],
-    });
-
-    await boot.click("btn-settings");
-    await chooseNetwork(boot, "sepolia");
-
-    const stored = boot.storage.read("autistmask");
-    expect(stored.networkId).toBe("sepolia");
-    expect(stored.fraudContracts).toEqual([]);
-});
-
-// The contract lookup on SettingsAddToken answers on Ethereum Mainnet while the
-// switch to Sepolia waits for the lock. The page adds the token to Ethereum
-// Mainnet's list. The switch then keeps that list for Ethereum Mainnet.
-test("a token added while a switch in Settings waits for the lock stays tracked on Ethereum Mainnet", async () => {
-    const boot = await bootOnAddToken("mainnet");
-    expect(boot.pageErrors).toEqual([]);
-    const { lookupTokenInfo } = require("../src/shared/balances");
-    let answer;
-    lookupTokenInfo.mockImplementationOnce(
-        () =>
-            new Promise((resolve) => {
-                answer = resolve;
-            }),
-    );
-    boot.node("settings-addtoken-address").value = NEW_TOKEN_ADDRESS;
-    const adding = boot.click("btn-settings-addtoken-manual");
-    await boot.click("btn-settings");
-
-    // Another write holds the lock, so the switch's save waits for it.
-    let releaseLock;
-    const lockHeld = navigator.locks.request(
-        "autistmask",
-        () =>
-            new Promise((resolve) => {
-                releaseLock = resolve;
-            }),
-    );
-    const select = boot.node("settings-network");
-    select.value = "sepolia";
-    const switching = Promise.all(select.listeners.change.map((fn) => fn()));
-    await boot.settle();
-
-    answer({ symbol: "NEW", decimals: 18, name: "New Token" });
-    await boot.settle();
-    releaseLock();
-    await lockHeld;
-    await switching;
-    await adding;
-
-    const stored = boot.storage.read("autistmask");
-    expect(stored.networkId).toBe("sepolia");
-    expect(stored.trackedTokens).toEqual([]);
-    expect(stored.networkTrackedTokens.mainnet).toEqual([
-        {
-            address: NEW_TOKEN_ADDRESS,
-            symbol: "NEW",
-            decimals: 18,
-            name: "New Token",
-        },
-    ]);
-});
-
 describe("Back after a switch from the Settings gear", () => {
     test("SettingsAddToken no longer offers the common tokens", async () => {
         const boot = await bootOnAddToken("mainnet");

tests/transactionDetailLateAnswer.test.js

@@ -1,202 +0,0 @@
-// TransactionDetail shows only details that Blockscout gave for the
-// transaction on screen (https://git.eeqj.de/sneak/AutistMask/issues/675).
-//
-// The screen asks Blockscout for its transaction and does not wait for the
-// answer. So the user can press Back and open another transaction before
-// Blockscout answers for the first. The first answer must then fill nothing on
-// the second transaction's screen. An answer that lands while Settings is up
-// must still fill TransactionDetail.
-//
-// Driven through the real popup over a stored profile
-// (tests/support/popupBoot.js). Each transaction is opened as a history screen
-// opens it: the current screen is pushed, then transactionDetail.show() draws
-// the transaction.
-
-"use strict";
-
-const {
-    bootPopup,
-    cleanupPopup,
-    unversionedValidProfile,
-    ADDRESS,
-} = require("./support/popupBoot");
-
-const MAINNET_BLOCKSCOUT = "https://eth.blockscout.com/api/v2";
-const SEPOLIA_BLOCKSCOUT = "https://eth-sepolia.blockscout.com/api/v2";
-const RECIPIENT = "0x2222222222222222222222222222222222222222";
-
-// A history entry for a send of 1 `symbol` from ADDRESS to RECIPIENT, on the
-// network with `chainId`.
-function historyEntry(hash, chainId, symbol) {
-    return {
-        hash,
-        from: ADDRESS,
-        to: RECIPIENT,
-        value: "1.0000",
-        exactValue: "1.0",
-        symbol,
-        timestamp: 1790000000,
-        isError: false,
-        direction: "sent",
-        directionLabel: "Sent",
-        contractAddress: null,
-        chainId,
-    };
-}
-
-const FIRST = historyEntry("0x" + "aa".repeat(32), "0x1", "ETH");
-const SECOND = historyEntry("0x" + "bb".repeat(32), "0x1", "ETH");
-// A transaction on Sepolia with the same hash as FIRST.
-const FIRST_ON_SEPOLIA = historyEntry(FIRST.hash, "0xaa36a7", "SepoliaETH");
-
-// The URL that asks Blockscout for `entry`, on the network it was sent on.
-function requestUrl(entry) {
-    const blockscout =
-        entry.chainId === "0x1" ? MAINNET_BLOCKSCOUT : SEPOLIA_BLOCKSCOUT;
-    return blockscout + "/transactions/" + entry.hash;
-}
-
-// What Blockscout reports for each transaction, by the URL that asks for it.
-const ANSWERS = {
-    [requestUrl(FIRST)]: {
-        block_number: 21000001,
-        nonce: 4441,
-        fee: { value: "21000000000000" },
-        raw_input: "0x11111111",
-        method: "firstMethod",
-    },
-    [requestUrl(SECOND)]: {
-        block_number: 21000002,
-        nonce: 4442,
-        fee: { value: "42000000000000" },
-        raw_input: "0x22222222",
-        method: "secondMethod",
-    },
-    [requestUrl(FIRST_ON_SEPOLIA)]: {
-        block_number: 21000003,
-        nonce: 4443,
-        fee: { value: "63000000000000" },
-        raw_input: "0x33333333",
-        method: "sepoliaMethod",
-    },
-};
-
-// The text each answer puts on screen: its block, nonce, fee, method name and
-// raw data. No text from one answer appears in another.
-const FIRST_SHOWN = [
-    "21000001",
-    "4441",
-    "0.000021 ETH",
-    "firstMethod",
-    "0x11111111",
-];
-const SECOND_SHOWN = [
-    "21000002",
-    "4442",
-    "0.000042 ETH",
-    "secondMethod",
-    "0x22222222",
-];
-const FIRST_ON_SEPOLIA_SHOWN = [
-    "21000003",
-    "4443",
-    "0.000063 SepoliaETH",
-    "sepoliaMethod",
-    "0x33333333",
-];
-
-// Everything drawn in the fields that Blockscout's answer fills.
-function drawnDetails(page) {
-    return [
-        "tx-detail-block",
-        "tx-detail-nonce",
-        "tx-detail-fee",
-        "tx-detail-calldata-action",
-        "tx-detail-rawdata",
-    ]
-        .map((id) => page.node(id).innerHTML + page.node(id).textContent)
-        .join("\n");
-}
-
-// Opens `entry` on TransactionDetail, as a history screen does.
-function open(entry) {
-    require("../src/popup/views/helpers").pushCurrentView();
-    require("../src/popup/views/transactionDetail").show(entry);
-}
-
-// The URLs of every request to Blockscout so far, in order.
-function requestedUrls() {
-    return globalThis.fetch.mock.calls.map(([url]) => url);
-}
-
-// Boots the popup on Home with "Use Blockscout" on. Blockscout answers every
-// request at once from ANSWERS, except the request for `held`. Returns the
-// page and answer(), which lets the answer for `held` land.
-async function bootWithHeldRequest(held) {
-    const page = await bootPopup(
-        unversionedValidProfile({ useBlockscout: true }),
-    );
-    let answer;
-    const heldAnswer = new Promise((resolve) => {
-        answer = resolve;
-    });
-    globalThis.fetch = jest.fn(async (url) => {
-        if (url === requestUrl(held)) await heldAnswer;
-        return { ok: true, status: 200, json: async () => ANSWERS[url] };
-    });
-    return { page, answer: () => answer() };
-}
-
-// The user opens `first`, whose request to Blockscout is held. Then the user
-// presses Back and opens `second`. Then the answer for `first` lands. Returns
-// the page.
-async function firstAnswerLandsOnSecond(first, second) {
-    const { page, answer } = await bootWithHeldRequest(first);
-    open(first);
-    await page.settle();
-    await page.click("btn-tx-back");
-    expect(page.visibleViews()).toEqual(["main"]);
-    open(second);
-    await page.settle();
-    expect(requestedUrls()).toEqual([requestUrl(first), requestUrl(second)]);
-    answer();
-    await page.settle();
-    expect(page.visibleViews()).toEqual(["transaction"]);
-    return page;
-}
-
-afterEach(() => {
-    cleanupPopup();
-});
-
-test("an answer for the first transaction that lands on the second one's screen fills nothing", async () => {
-    const page = await firstAnswerLandsOnSecond(FIRST, SECOND);
-
-    const drawn = drawnDetails(page);
-    for (const text of SECOND_SHOWN) expect(drawn).toContain(text);
-    for (const text of FIRST_SHOWN) expect(drawn).not.toContain(text);
-});
-
-test("an answer for a hash on mainnet that lands on the same hash's screen on Sepolia fills nothing", async () => {
-    const page = await firstAnswerLandsOnSecond(FIRST, FIRST_ON_SEPOLIA);
-
-    const drawn = drawnDetails(page);
-    for (const text of FIRST_ON_SEPOLIA_SHOWN) expect(drawn).toContain(text);
-    for (const text of FIRST_SHOWN) expect(drawn).not.toContain(text);
-});
-
-test("an answer that lands while Settings is up still fills TransactionDetail", async () => {
-    const { page, answer } = await bootWithHeldRequest(FIRST);
-    open(FIRST);
-    await page.settle();
-    await page.click("btn-settings");
-    expect(page.visibleViews()).toEqual(["settings"]);
-    answer();
-    await page.settle();
-    await page.click("btn-settings");
-
-    expect(page.visibleViews()).toEqual(["transaction"]);
-    expect(requestedUrls()).toEqual([requestUrl(FIRST)]);
-    const drawn = drawnDetails(page);
-    for (const text of FIRST_SHOWN) expect(drawn).toContain(text);
-});

tests/transactions.test.js

@@ -144,7 +144,6 @@ function tokenTx(overrides = {}) {
         isError: false,
         contractAddress: USDC_CONTRACT,
         holders: 3500000,
-        chainId: "0x1",
         ...overrides,
     };
 }
@@ -260,32 +259,6 @@ describe("known-symbol spoof verification", () => {
         expect(result.newFraudContracts).toEqual([NOVEL_SPAM_CONTRACT]);
     });
 
-    // https://git.eeqj.de/sneak/AutistMask/issues/632: the bundled list holds
-    // mainnet contracts, so its symbols are not known symbols on Sepolia.
-    test("on Sepolia, a bundled symbol from another contract is kept", () => {
-        const sepoliaToken = tokenTx({
-            symbol: "USDC",
-            contractAddress: NOVEL_SPAM_CONTRACT,
-            holders: 5000000,
-            chainId: "0xaa36a7",
-        });
-        const result = filterTransactions([sepoliaToken], filters());
-        expect(result.transactions).toEqual([sepoliaToken]);
-        expect(result.newFraudContracts).toEqual([]);
-    });
-
-    test('on Sepolia, "ETH" as an ERC-20 is still spoofed', () => {
-        const fakeEth = tokenTx({
-            symbol: "ETH",
-            contractAddress: NOVEL_SPAM_CONTRACT,
-            holders: 5000000,
-            chainId: "0xaa36a7",
-        });
-        expect(filterTransactions([fakeEth], filters()).transactions).toEqual(
-            [],
-        );
-    });
-
     test("the genuine contract for that symbol is not spoofed", () => {
         const genuine = tokenTx();
         const result = filterTransactions([genuine], filters());
@@ -1522,41 +1495,6 @@ describe("fetchRecentTransactions merge and dedup", () => {
         expect(mainnet[0].chainId).toBe("0x1");
     });
 
-    // https://git.eeqj.de/sneak/AutistMask/issues/632: the bundled token list
-    // names a contract only on Ethereum Mainnet. On Sepolia, a call to the
-    // contract at USDC's mainnet address is labelled with the network's native
-    // currency. A call to any contract the wallet does not name gets that label.
-    test("a contract call on Sepolia is not named by the bundled list", async () => {
-        respondWith(
-            [
-                {
-                    hash: "0x" + "b".repeat(64),
-                    block_number: 21000095,
-                    timestamp: TS,
-                    from: { hash: VICTIM },
-                    to: { hash: USDC_CONTRACT, is_contract: true },
-                    value: "0",
-                    method: "approve",
-                    status: "ok",
-                },
-            ],
-            [],
-        );
-        const sepolia = await fetchRecentTransactions(
-            VICTIM,
-            BLOCKSCOUT,
-            "0xaa36a7",
-        );
-        expect(sepolia[0].directionLabel).toBe("Approve");
-        expect(sepolia[0].symbol).toBe("SepoliaETH");
-        const mainnet = await fetchRecentTransactions(
-            VICTIM,
-            BLOCKSCOUT,
-            "0x1",
-        );
-        expect(mainnet[0].symbol).toBe("USDC");
-    });
-
     test("the fake token transfer survives fetching and is then filtered", async () => {
         respondWith(
             [],

tests/uniswap.test.js

@@ -3316,41 +3316,18 @@ describe("uniswap decoder", () => {
         // token nothing knows. On next at 53551c6 such a permit's Allowance
         // token line read ETH. A permit of 1 wei of the zero address before a
         // V4 step of 5 ETH made the Amount line read 0.000000000000000001 ETH.
-        // With that permit to another spender and a SETTLE the router pays, no
-        // line gave the 5 ETH.
         describe("a permit on the zero address", () => {
             const FIVE_ETH = 5000000000000000000n;
             // The lines of a permit of `amount` base units of the zero
-            // address for `spender`.
-            const zeroAddressLines = (amount, spender) => [
+            // address for the router.
+            const zeroAddressLines = (amount) => [
                 [
                     "Permit2 allowance",
                     amount + " base units (decimals unknown)",
                 ],
                 ["Allowance token", ZERO_ADDR],
-                ["Allowance spender", getAddress(spender)],
+                ["Allowance spender", getAddress(ROUTER_ADDR)],
             ];
-            // A V4 swap of 5 ETH for USDC. The user pays its SETTLE when
-            // `payerIsUser` is true; otherwise the router pays it from the
-            // transaction's value.
-            const v4FiveEth = (payerIsUser) =>
-                encodeV4Swap(
-                    new Uint8Array([
-                        V4_SWAP_EXACT_IN_SINGLE_ID,
-                        V4_SETTLE_ID,
-                        V4_TAKE_ALL_ID,
-                    ]),
-                    [
-                        encodeV4ExactInSingle(
-                            ZERO_ADDR,
-                            USDC_ADDR,
-                            FIVE_ETH,
-                            1n,
-                        ),
-                        settle(ZERO_ADDR, FIVE_ETH, payerIsUser),
-                        encodeV4TakeAll(USDC_ADDR, 1n),
-                    ],
-                );
 
             test("a PERMIT2_PERMIT on the zero address names the address", () => {
                 const result = decodeSteps(
@@ -3366,7 +3343,7 @@ describe("uniswap decoder", () => {
                 );
                 expect(linesBetweenTokens(result)).toEqual([
                     ["Amount", "600.0000 USDT"],
-                    ...zeroAddressLines("1000000000000000000", ROUTER_ADDR),
+                    ...zeroAddressLines("1000000000000000000"),
                 ]);
                 expect(detail(result, "Allowance token").address).toBe(
                     ZERO_ADDR,
@@ -3390,7 +3367,7 @@ describe("uniswap decoder", () => {
                 expect(linesBetweenTokens(result)).toEqual([
                     ["Amount", "600.0000 USDT"],
                     ...USDT_600_LINES,
-                    ...zeroAddressLines("1000000000000000000", ROUTER_ADDR),
+                    ...zeroAddressLines("1000000000000000000"),
                 ]);
             });
 
@@ -3399,219 +3376,6 @@ describe("uniswap decoder", () => {
                     [0x0a, 0x10],
                     [
                         encodePermit2(ZERO_ADDR, 1n, ROUTER_ADDR),
-                        v4FiveEth(true),
-                    ],
-                );
-                expect(detail(result, "Token In").value).toBe("ETH (native)");
-                expect(linesBetweenTokens(result)).toEqual([
-                    ["Amount", "5.0000 ETH"],
-                    ...zeroAddressLines("1", ROUTER_ADDR),
-                ]);
-            });
-
-            test("a PERMIT2_PERMIT of 1 wei of the zero address to another spender, then a V4 step of 5 ETH the router settles, shows the 5 ETH", () => {
-                const result = decodeSteps(
-                    [0x0a, 0x10],
-                    [
-                        encodePermit2(ZERO_ADDR, 1n, OTHER_ADDR),
-                        v4FiveEth(false),
-                    ],
-                );
-                expect(detail(result, "Token In").value).toBe("ETH (native)");
-                expect(linesBetweenTokens(result)).toEqual([
-                    ["Amount", "5.0000 ETH"],
-                    ...zeroAddressLines("1", OTHER_ADDR),
-                ]);
-            });
-
-            test("a PERMIT2_PERMIT_BATCH entry of 1 wei of the zero address to another spender, then a V4 step of 5 ETH the router settles, shows the 5 ETH", () => {
-                const result = decodeSteps(
-                    [0x03, 0x10],
-                    [
-                        encodePermit2Batch([[ZERO_ADDR, 1n]], OTHER_ADDR),
-                        v4FiveEth(false),
-                    ],
-                );
-                expect(detail(result, "Token In").value).toBe("ETH (native)");
-                expect(linesBetweenTokens(result)).toEqual([
-                    ["Amount", "5.0000 ETH"],
-                    ...zeroAddressLines("1", OTHER_ADDR),
-                ]);
-            });
-        });
-
-        // https://git.eeqj.de/sneak/AutistMask/issues/685 — Permit2 moves no
-        // ETH, so a PERMIT2_TRANSFER_FROM of the zero address reads as a move
-        // of a token nothing knows. On next at ec6b6b5 its lines read ETH,
-        // with an ETH figure.
-        describe("a PERMIT2_TRANSFER_FROM of the zero address", () => {
-            const MOVED_AMOUNT =
-                "1000000000000000000 base units (decimals unknown)";
-
-            test("to another address names the address", () => {
-                const result = decodeSteps(
-                    [0x00, 0x02],
-                    [V3_600, transfer(ZERO_ADDR, OTHER_ADDR, ONE_WETH)],
-                );
-                expect(linesBetweenTokens(result)).toEqual([
-                    ["Amount", "600.0000 USDT"],
-                    ["Moved from the sender", MOVED_AMOUNT],
-                    ["Token moved", ZERO_ADDR],
-                    ["Moved to", OTHER_ADDR],
-                ]);
-                expect(detail(result, "Token moved").address).toBe(ZERO_ADDR);
-            });
-
-            test("into the router names the address", () => {
-                const result = decodeSteps(
-                    [0x02, 0x00],
-                    [transfer(ZERO_ADDR, ROUTER_ADDR, ONE_WETH), V3_600],
-                );
-                expect(detail(result, "Paid to").value).toBe(
-                    "The router, " +
-                        MOVED_AMOUNT +
-                        " from the sender (later steps may not spend all of it)",
-                );
-                expect(detail(result, "Token moved into the router")).toEqual({
-                    label: "Token moved into the router",
-                    value: ZERO_ADDR,
-                    address: ZERO_ADDR,
-                    isToken: true,
-                });
-            });
-
-            // The V4 step's SETTLE names the user as payer and states no
-            // amount. The step's lines say that the ETH amount is not known.
-            test("after a V4 exact-out step of ETH, also shows that the ETH amount is not known", () => {
-                const v4EthExactOut = encodeV4Swap(
-                    new Uint8Array([
-                        V4_SWAP_EXACT_OUT_SINGLE_ID,
-                        V4_SETTLE_ID,
-                        V4_TAKE_ALL_ID,
-                    ]),
-                    [
-                        encodeV4ExactOutSingle(
-                            ZERO_ADDR,
-                            USDC_ADDR,
-                            590000000n,
-                            ONE_WETH,
-                        ),
-                        encodeV4Settle(ZERO_ADDR),
-                        encodeV4TakeAll(USDC_ADDR, 0n),
-                    ],
-                );
-                const result = decodeSteps(
-                    [0x10, 0x02],
-                    [v4EthExactOut, transfer(ZERO_ADDR, OTHER_ADDR, ONE_WETH)],
-                );
-                expect(detail(result, "Token In").value).toBe("ETH (native)");
-                expect(linesBetweenTokens(result)).toEqual([
-                    ["Moved from the sender", UNDECODED],
-                    ["Token moved", "ETH"],
-                    ["Moved to", "The swap step that spends it"],
-                    ["Moved from the sender", MOVED_AMOUNT],
-                    ["Token moved", ZERO_ADDR],
-                    ["Moved to", OTHER_ADDR],
-                ]);
-            });
-        });
-
-        // https://git.eeqj.de/sneak/AutistMask/issues/682 — V4 pays a SETTLE
-        // of ETH from the router's own ETH, whichever payer the SETTLE names,
-        // and the router holds the transaction's value. On next at 36b2002 a
-        // SETTLE of 1 ETH that names the router as payer gave no ETH line.
-        describe("a V4 SETTLE of ETH that names the router as payer", () => {
-            const ONE_ETH = 1000000000000000000n;
-            // A V4 swap of `amount` of ETH for USDC. The SETTLE names the
-            // router as payer.
-            const v4EthFromRouter = (amount) =>
-                encodeV4Swap(
-                    new Uint8Array([
-                        V4_SWAP_EXACT_IN_SINGLE_ID,
-                        V4_SETTLE_ID,
-                        V4_TAKE_ALL_ID,
-                    ]),
-                    [
-                        encodeV4ExactInSingle(ZERO_ADDR, USDC_ADDR, amount, 1n),
-                        settle(ZERO_ADDR, amount, false),
-                        encodeV4TakeAll(USDC_ADDR, 1n),
-                    ],
-                );
-
-            test("after a V3 exact-in of 600 USDT, shows the 1 ETH moved from the sender", () => {
-                const result = decodeSteps(
-                    [0x00, 0x10],
-                    [V3_600, v4EthFromRouter(ONE_ETH)],
-                );
-                expect(linesBetweenTokens(result)).toEqual([
-                    ["Amount", "600.0000 USDT"],
-                    ["Moved from the sender", "1.0000 ETH"],
-                    ["Token moved", "ETH"],
-                    ["Moved to", "The swap step that spends it"],
-                ]);
-            });
-
-            // The UNWRAP_WETH leaves ETH in the router. The SETTLE may spend
-            // that ETH before the transaction's value.
-            test("after an UNWRAP_WETH into the router, shows at most 1 ETH moved from the sender", () => {
-                const result = decodeSteps(
-                    [0x00, 0x0c, 0x10],
-                    [
-                        encodeV3SwapExactIn(ROUTER_ADDR, USDT_600, 1n, [
-                            USDT_ADDR,
-                            WETH_ADDR,
-                        ]),
-                        encodeWrapEth(ROUTER_ADDR, 0n), // UNWRAP_WETH, same encoding
-                        v4EthFromRouter(ONE_ETH),
-                    ],
-                );
-                expect(linesBetweenTokens(result)).toEqual([
-                    ["Amount", "600.0000 USDT"],
-                    ["Moved from the sender", "Up to 1.0000 ETH"],
-                    ["Token moved", "ETH"],
-                    ["Moved to", "The swap step that spends it"],
-                ]);
-            });
-
-            test("after a WRAP_ETH of 0.5 ETH, adds the SETTLE's 0.5 ETH to the Amount line", () => {
-                const result = decodeSteps(
-                    [0x0b, 0x10],
-                    [
-                        encodeWrapEth(ROUTER_ADDR, ONE_ETH / 2n),
-                        v4EthFromRouter(ONE_ETH / 2n),
-                    ],
-                );
-                expect(linesBetweenTokens(result)).toEqual([
-                    ["Amount", "1.0000 ETH"],
-                ]);
-            });
-
-            // The WRAP_ETH sets Token In to ETH, and the UNWRAP_WETH leaves
-            // ETH in the router. The SETTLE may spend that ETH before the
-            // transaction's value, so its 1 ETH never joins the Amount line.
-            test("after a WRAP_ETH and an UNWRAP_WETH into the router, keeps the Amount line and shows at most 1 ETH moved from the sender", () => {
-                const result = decodeSteps(
-                    [0x0b, 0x0c, 0x10],
-                    [
-                        encodeWrapEth(ROUTER_ADDR, ONE_ETH / 2n),
-                        encodeWrapEth(ROUTER_ADDR, 0n), // UNWRAP_WETH, same encoding
-                        v4EthFromRouter(ONE_ETH),
-                    ],
-                );
-                expect(linesBetweenTokens(result)).toEqual([
-                    ["Amount", "0.5000 ETH"],
-                    ["Moved from the sender", "Up to 1.0000 ETH"],
-                    ["Token moved", "ETH"],
-                    ["Moved to", "The swap step that spends it"],
-                ]);
-            });
-
-            // A SETTLE of CONTRACT_BALANCE pays all the router holds, an
-            // amount the calldata does not state.
-            test("of CONTRACT_BALANCE, on the step that sets the input side, shows an unknown amount moved from the sender", () => {
-                const result = decodeSteps(
-                    [0x10],
-                    [
                         encodeV4Swap(
                             new Uint8Array([
                                 V4_SWAP_EXACT_IN_SINGLE_ID,
@@ -3622,19 +3386,19 @@ describe("uniswap decoder", () => {
                                 encodeV4ExactInSingle(
                                     ZERO_ADDR,
                                     USDC_ADDR,
-                                    ONE_ETH,
+                                    FIVE_ETH,
                                     1n,
                                 ),
-                                settle(ZERO_ADDR, 2n ** 255n, false), // CONTRACT_BALANCE
+                                settle(ZERO_ADDR, FIVE_ETH, true),
                                 encodeV4TakeAll(USDC_ADDR, 1n),
                             ],
                         ),
                     ],
                 );
+                expect(detail(result, "Token In").value).toBe("ETH (native)");
                 expect(linesBetweenTokens(result)).toEqual([
-                    ["Moved from the sender", UNDECODED],
-                    ["Token moved", "ETH"],
-                    ["Moved to", "The swap step that spends it"],
+                    ["Amount", "5.0000 ETH"],
+                    ...zeroAddressLines("1"),
                 ]);
             });
         });
@@ -4380,9 +4144,10 @@ describe("uniswap decoder", () => {
         expect(detail(result, "Min. received").value).toBe("2.0000 USDC");
     });
 
-    // A zero balance check sets neither Token Out nor the minimum. The route
-    // pays only the WRAP_ETH's WETH, to the router, where it stays.
-    test("a zero balance check after a WRAP_ETH into the router names no output token and no minimum", () => {
+    // With no minimum stated before it, a zero balance check is what sets the
+    // output side, and it guarantees nothing. No step pays anyone, so the
+    // minimum is not said to be received.
+    test("a zero balance check with no earlier minimum states no minimum", () => {
         const data = buildExecute(
             solidityPacked(["uint8", "uint8"], [0x0b, 0x0e]),
             [
@@ -4395,16 +4160,9 @@ describe("uniswap decoder", () => {
         const result = uniswap.decode(data, ROUTER_ADDR, "0x1", {}, USER_ADDR);
         expect(result).not.toBeNull();
 
-        expect(detail(result, "Token Out").value).toBe(
-            "Unknown (not named in the calldata)",
-        );
-        expect(detail(result, "Min. paid out")).toBeUndefined();
-        expect(detail(result, "Min. received")).toBeUndefined();
-        expect(detail(result, "Paid to").value).toBe(
-            "The router, where it stays (no later step pays it out)",
-        );
-        expect(detail(result, "Token moved into the router").address).toBe(
-            WETH_ADDR,
+        expect(detail(result, "Token Out").value).toContain("USDT");
+        expect(detail(result, "Min. paid out").value).toBe(
+            "None (no minimum guaranteed)",
         );
     });
 

tests/uniswapRecipient.test.js

@@ -688,62 +688,6 @@ describe("an UNWRAP_WETH makes the output ETH only when the router holds it", ()
         ]);
     });
 
-    // The same route, then a balance check of the sender's USDC with a zero
-    // minimum. The check guarantees nothing, so Token Out stays ETH
-    // (https://git.eeqj.de/sneak/AutistMask/issues/649).
-    test("the same route, then a zero balance check of USDC, still reads as ETH with no minimum", () => {
-        const result = decode(
-            execute(
-                v4Swap(
-                    SWAP_USDT_FOR_WETH,
-                    SETTLE_USDT,
-                    take(WETH, MSG_SENDER, (ONE_WETH * 6n) / 10n),
-                    take(WETH, ADDRESS_THIS),
-                ),
-                unwrapWeth(MSG_SENDER),
-                balanceCheck(USDC, 0n),
-            ),
-        );
-        expect(result.name).toBe("Swap USDT → ETH");
-        expect(detail(result, "Token Out").value).toBe("ETH");
-        expect(labels(result)).toEqual([
-            "Protocol",
-            "Token In",
-            "Amount",
-            "Token Out",
-            "Steps",
-            "Deadline",
-        ]);
-    });
-
-    // A PERMIT2_TRANSFER_FROM moves the sender's WETH into the router. An
-    // UNWRAP_WETH pays that WETH to the user as ETH. A zero balance check of
-    // USDC sets neither Token Out nor the minimum, before the UNWRAP_WETH or
-    // after it (https://git.eeqj.de/sneak/AutistMask/issues/649).
-    test.each([
-        {
-            kind: "before the UNWRAP_WETH",
-            steps: [balanceCheck(USDC, 0n), unwrapWeth(MSG_SENDER)],
-        },
-        {
-            kind: "after the UNWRAP_WETH",
-            steps: [unwrapWeth(MSG_SENDER), balanceCheck(USDC, 0n)],
-        },
-    ])(
-        "WETH moved into the router and unwrapped, with a zero balance check of USDC $kind, reads as ETH with no minimum",
-        ({ steps }) => {
-            const result = decode(
-                execute(
-                    permit2TransferFrom(WETH, ADDRESS_THIS, ONE_WETH),
-                    ...steps,
-                ),
-            );
-            expect(detail(result, "Token Out").value).toBe("ETH");
-            expect(detail(result, "Min. received")).toBeUndefined();
-            expect(detail(result, "Min. paid out")).toBeUndefined();
-        },
-    );
-
     // A TAKE the decoder cannot read may pay part of the WETH to the user.
     test("one V4 step paying WETH to the router beside a TAKE that cannot be read, then an UNWRAP_WETH, reads as ETH with no minimum", () => {
         const result = decode(
@@ -1717,18 +1661,9 @@ describe("any token left in the router is not received", () => {
             ),
             min: "1990.0000 USDC",
         },
-    ])("$kind reads as a swap paid to the user", ({ data, min }) => {
-        const result = decode(data);
-        expect(labels(result)).toEqual(PAID_TO_USER);
-        expect(detail(result, "Min. received").value).toBe(min);
-    });
-
-    // https://git.eeqj.de/sneak/AutistMask/issues/682 — the SETTLE spends all
-    // the router's ETH, the transaction's value included, so the sender pays
-    // an amount the calldata does not state.
-    test("a swap paying WETH to the router, an UNWRAP_WETH into the router, then a V4 swap settling all the ETH from the router reads as a swap paid to the user", () => {
-        const result = decode(
-            execute(
+        {
+            kind: "a swap paying WETH to the router, an UNWRAP_WETH into the router, then a V4 swap settling all the ETH from the router",
+            data: execute(
                 swapToWeth(ADDRESS_THIS),
                 unwrapWeth(ADDRESS_THIS),
                 v4Swap(
@@ -1737,23 +1672,12 @@ describe("any token left in the router is not received", () => {
                     takeAll(USDC),
                 ),
             ),
-        );
-        expect(labels(result)).toEqual([
-            "Protocol",
-            "Token In",
-            "Amount",
-            "Moved from the sender",
-            "Token moved",
-            "Moved to",
-            "Token Out",
-            "Min. received",
-            "Steps",
-            "Deadline",
-        ]);
-        expect(detail(result, "Moved from the sender").value).toBe(
-            "Unknown (could not be decoded)",
-        );
-        expect(detail(result, "Min. received").value).toBe("1990.0000 USDC");
+            min: "1990.0000 USDC",
+        },
+    ])("$kind reads as a swap paid to the user", ({ data, min }) => {
+        const result = decode(data);
+        expect(labels(result)).toEqual(PAID_TO_USER);
+        expect(detail(result, "Min. received").value).toBe(min);
     });
 });
 
@@ -2876,16 +2800,17 @@ describe("the allow-revert flag", () => {
         },
     );
 
-    test("a BALANCE_CHECK_ERC20 with the flag, and no minimum before it, names no output token and no minimum", () => {
+    test("a BALANCE_CHECK_ERC20 with the flag, and no minimum before it, states none", () => {
         const check = balanceCheck(WETH, ONE_WETH);
         expect(detail(decode(execute(check)), "Min. paid out").value).toBe(
             "1.0000 WETH",
         );
 
         const withFlag = decode(execute(flagged(check)));
-        expect(detail(withFlag, "Token Out").value).toBe(UNNAMED);
-        expect(detail(withFlag, "Min. paid out")).toBeUndefined();
-        expect(detail(withFlag, "Min. received")).toBeUndefined();
+        expect(detail(withFlag, "Token Out").address).toBe(WETH);
+        expect(detail(withFlag, "Min. paid out").value).toBe(
+            "None (no minimum guaranteed)",
+        );
     });
 
     // Only the routers from UniversalRouterV2 on let a PERMIT2_PERMIT fail.

tests/unknownScaleDisplay.test.js

@@ -103,7 +103,7 @@ describe("balanceLine", () => {
     });
 
     test("an unknown quantity produces no fiat figure, a zero one does", () => {
-        prices[NOVEL] = 3;
+        prices.NOVEL = 3;
         const unknown = balanceLine("NOVEL", null, 3, NOVEL);
         const zero = balanceLine("NOVEL", 0, 3, NOVEL);
         // A price times an unknown quantity is not $0.00: that is the same
@@ -162,7 +162,7 @@ describe("getAddressValue", () => {
     // make it incomplete.
     test("an unknown balance makes the total partial, a zero balance does not", () => {
         prices.ETH = 2000;
-        prices[NOVEL] = 3;
+        prices.NOVEL = 3;
         const unknown = getAddressValue(address(null));
         const zero = getAddressValue(address("0.0"));
         expect(unknown).not.toEqual(zero);
@@ -172,7 +172,7 @@ describe("getAddressValue", () => {
 
     test("an unknown balance is not priced as zero of the token", () => {
         prices.ETH = 2000;
-        prices[NOVEL] = 3;
+        prices.NOVEL = 3;
         // The same row with a real quantity of 10 is worth $30. Neither that
         // figure nor a confident $0.00 may be stated for the unknown one.
         expect(getAddressValue(address("10.0"))).toEqual({

tests/unknownScaleSend.test.js

@@ -167,8 +167,7 @@ function row(token = {}, value = FIVE_WETH) {
 }
 
 // Fetch the explorer's rows through the real fetcher and put them exactly where
-// refreshBalances() puts them on Ethereum Mainnet. The node reports the holding
-// the explorer does.
+// refreshBalances() puts them. The node reports the holding the explorer does.
 async function fetchOnto(items) {
     mockProvider.tokenUnits = BigInt(items[0].value);
     debugFetch.mockImplementation(async () => ({
@@ -177,7 +176,7 @@ async function fetchOnto(items) {
         statusText: "OK",
         json: async () => items,
     }));
-    const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, [], "0x1");
+    const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, []);
     state.wallets = [
         {
             name: "Wallet 1",